<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="365">
<package pkgid="f5fa1142db59370ef19dcbbde52b994baaa74e55689ad51c19aa87088e267981" name="aaa_base" arch="aarch64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.6.2"/>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
</package>
<package pkgid="2d9cd00800f7ef65ac5f5524fb1227f10ebdb9e2ea06ca08e2e8d947dbf351d8" name="aaa_base" arch="s390x">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.6.2"/>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
</package>
<package pkgid="2a7c2126b5e581ac05ee8a053221d803b1a6fe144cac1ad4ad5690e9b15a83d0" name="aaa_base" arch="src">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.6.2"/>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
</package>
<package pkgid="2dc73f3ef22c6319257ab268fe8fd1f4628d9a06652a426fd84a37b465809d80" name="aaa_base" arch="x86_64">
  <version epoch="0" ver="84.87+git20180409.04c9dae" rel="150300.10.6.2"/>
  <changelog author="ro@suse.de" date="1566475200">- Add patch git-07-82a17f1689e8957635c8ccaae7c9b3bff7f94d49.patch
  * add sysctl.d/51-network.conf to tighten network security a bit
    see also (boo#1146866) (jira#SLE-9132)</changelog>
  <changelog author="ro@suse.de" date="1570622400">- Add patch git-08-9875dffab3ddda0c3e8399f935f059246c961f2a.patch
  * Add s390x compressed kernel support (bsc#1151023)
- Add git-09-c6cd010dd8b6efddd71c30f00a923d8f2537584c.patch
  * Fix LC_NAME and LC_ADDRESS in sh.ssh
- Add patch git-10-43091e644ff54997468a215b891dcaa75173f133.patch
  * fix string test to arithmetic test in /etc/profile.d/wsl.sh</changelog>
  <changelog author="ro@suse.de" date="1570708800">- Add patch git-11-b20083a930f766939f47dddc66d089c9fee5d38a.patch
  * check if variables can be set before modifying them
    to avoid warnings on login with a restricted shell
    (bsc#1138869)</changelog>
  <changelog author="ro@suse.de" date="1571227200">- Add patch git-12-80d14205f913cc67a98c562f988ea700a56c369b.patch
  * service: check if there is a second argument before using it
    (bsc#1051143)</changelog>
  <changelog author="werner@suse.de" date="1571313600">- Add patch git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  Use official key binding functions in inputrc
  that is replace up-history with previous-history, down-history with
  next-history and backward-delete-word with backward-kill-word
  (bsc#1084934).  Add some missed key escape sequences for urxvt-unicode
  terminal as well (boo#1007715).</changelog>
  <changelog author="werner@suse.de" date="1574251200">- Clear broken ghost entry in patch
  git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  which breaks (lib)readline (bsc#1157278)</changelog>
  <changelog author="ro@suse.de" date="1579176000">- Add patch git-14-12023f2e8aae5b2ac3a895301945566b9f5eb9c3.patch
  drop dev.cdrom.autoclose = 0 from sysctl config (bsc#1160970)</changelog>
  <changelog author="ro@suse.de" date="1581076800">- Add patch git-15-27e2c6180a45cca63d71ffa5de7b32dec749d2cd.patch
  change rp_filter to 2 to follow the current default (bsc#1160735)</changelog>
  <changelog author="ro@suse.de" date="1583236800">- Add patch git-16-ed897a1090cafb678f75dbed8802bd671d3c1921.patch
  get_kernel_version: fix for current kernel on s390x (from azouhr)
  (bsc#1151023) (bsc#1139939)
- Add patch git-17-fe967bddbd74af9aba435900878397c0c7ea0b0b.patch
  added "-h"/"--help" to "old" command (from Bernhard Lang)
- Add patch git-18-bb11f02d5dd940803c08d25b0cfd3650d9de7d41.patch
  change feedback url from http://www.suse.de/feedback to
  https://github.com/openSUSE/aaa_base/issues</changelog>
  <changelog author="werner@suse.de" date="1588852800">- Add patch git-19-1149066a54a372b30b7cbd79cd222e11d96dc984.patch
  * Not all XTerm based emulators do have an terminfo entry (boo#1087982)
- Add patch git-20-6452441f2054b4b290c089ce6269889993b95fc1.patch
  * Better support of Midnight Commander (bsc#1170527)</changelog>
  <changelog author="ro@suse.de" date="1599652800">- Add patch git-21-0064ecd132c30a939125acbc5b9a1c7bcd180fa0.patch
  * add screen.xterm-256color to DIR_COLORS
- Add patch git-22-f5e90d70d119b6aa12d019947029f9337aec378d.patch
  * check for Packages.db and use this instead of Packages
    (boo#1171762)
- Add patch git-23-8f1fe28287466235ade9c62fa5995eba9e642660.patch
  * Rename path() to _path() to avoid using a general name.
- Add patch git-24-2de52ae391e2963eb1913183a6b0530c7e781b55.patch
  * DIR_COLORS add TERM rxvt-unicode-256color (bug#1006973)
- Add patch git-25-287cf7cb851c0636fa46a610015d2d22ad36acea.patch
  * sort TERM entries in etc/DIR_COLORS
- Add patch git-26-0c2f2340cc6ebb51f20b36e550adc517a6b2ae42.patch
  * DIR_COLORS: merge TERM entries with list from (bug#1006973)
- Add patch git-27-abf7927eebbd4d7f47a362d49ae7856520682c49.patch
  * refresh_initrd call modprobe as /sbin/modprobe (bug#1011548)
- Add patch git-28-3351bcc9613ba022503103e7e4ffd01e7bd8e0fd.patch
  * etc/profile add some missing ;; in case esac statements
- Add patch git-29-5220a5f6ba250503ccda326e65ca069d245a5ebe.patch
  * profile and csh.login: on s390x set TERM to dumb on serial console
    for sclp_line0 and ttyS0 console (bug#1153946)
- Add patch git-30-b9dd70f33a124556f16dbbafc89585a82218ad61.patch
  * backup-rpmdb: exit if zypp.pid is there and running
    (bug#1161239)
- Add patch git-31-52dc403d54f2c926ee5cc892d1a8a830a45d7412.patch
  * also add color alias for ip command, jira#sle-9880, bsc#1153943
- Add patch git-32-0ee79834ea9ebf6573a7b903f374c21e53a56c14.patch
  * alias.bash check if ip command knows color=auto (jsc#SLE-7679)</changelog>
  <changelog author="ro@suse.de" date="1606824000">- Add patch git-33-d12420cc66e6d26a9dff6c0e86e00de232151c82.patch
  * Avoid semicolon within (t)csh login script on S/390.
    (bsc#1179431)</changelog>
  <changelog author="werner@suse.de" date="1633003200">- Include all fixes and changes for systemwide inputrc to remove
  the 8 bit escape sequence which interfere with UTF-8 multi byte
  characters as well as support the vi mode of readline library.
  This is done with the patches
  * git-41-f00ca2600331602241954533a1b1610d1da57edf.patch
  * git-42-f39a8d18719c3b34373e0e36098f0f404121b5c5.patch
  before the changed patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  rename it to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  and also add the patches
  * git-44-425f3e9b44ba9ead865d70ff6690d5f2869442dc.patch
  * git-45-bf0a31597d0ed3562bfc5e6be0ade2fe5dc1f7a1.patch</changelog>
  <changelog author="witold.bedyk@suse.com" date="1635336000">- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error</changelog>
  <changelog author="jgonzalez@suse.com" date="1635940800">- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)</changelog>
  <changelog author="ro@suse.de" date="1637150400">- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search</changelog>
  <changelog author="werner@suse.de" date="1637928000">- Port change from Thu Sep 30 08:51:55 UTC 2022 forword to
  current version which includes a rename of patch
    git-13-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  to
    git-43-14003c19eaa863ae9d80a0ebb9b5cab6273a5a9e.patch
  as otherwise autopatch macro does not work anymore</changelog>
  <changelog author="pgajdos@suse.com" date="1642593600">- fix (bsc#1194883) - aaa_base: Set net.ipv4.ping_group_range to
  allow ICMP ping
- added patches
  + git-40-d004657a244d75b372a107c4f6097b42ba1992d5.patch</changelog>
  <changelog author="werner@suse.de" date="1652875200">- Add patch git-46-78b2a0b29381c16bec6b2a8fc7eabaa9925782d7.patch
  * The wrapper rootsh is not a restricted shell (bsc#1199492)</changelog>
  <changelog author="ro@suse.de" date="1695038400">- Add patch git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
  * respect /etc/update-alternatives/java when setting JAVA_HOME
    (bsc#1215434,bsc#1107342)</changelog>
</package>
<package pkgid="2234c693e832e19a5c4b7ea4965e3f0c9639a36b507badfa96505dadad60cc06" name="apparmor" arch="src">
  <version epoch="0" ver="3.0.4" rel="150500.11.9.1"/>
  <changelog author="suse-beta@cboltz.de" date="1634299200">- add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1636459200">- add aa-notify-more-arch-mr809.diff: Add support for reading s390x
  and aarch64 wtmp files (boo#1181155)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1639915200">- add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and
  /etc/ssl/engines.d/ in abstractions/openssl which were introduced
  with the latest openssl update</changelog>
  <changelog author="nopower@suse.com" date="1640001600">-  Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED
  operation="file_mmap" violation in SLE15-SP4; (bsc#1192336).</changelog>
  <changelog author="scabrero@suse.de" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb (bsc#1192684).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1643198400">- add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221,
  MR 827)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1644494400">- update to AppArmor 3.0.4
  - various fixes in profiles, abstractions, apparmor_parser and utils
    (some of them were already included as patches)
  - add support for mctp address family
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4
    for the full upstream changelog
- remove upstream(ed) patches:
  - aa-notify-more-arch-mr809.diff
  - ruby-3.1-build-fix.diff
  - add-samba-bgqd.diff
  - openssl-engdef-mr818.diff
  - profiles-python-3.10-mr783.diff
  - update-samba-abstractions-ldb2.diff
- refresh patches:
  - apparmor-samba-include-permissions-for-shares.diff
  - ruby-2_0-mkmf-destdir.patch</changelog>
  <changelog author="nopower@suse.com" date="1648123200">- Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1648555200">- ensure precompiled cache files are newer than (text) profiles
- reload profiles in %posttrans instead of %post to ensure both
  - profiles and -abstractons package are updated before the cache
  in /var/cache/apparmor/ gets built (boo#1195463 #c20)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1649592000">- add profile for zgrep and xzgrep to prevent CVE-2022-1271
  (zgrep-profile-mr870.diff)</changelog>
  <changelog author="nopower@suse.com" date="1649678400">- Add samba_deny_net_admin.patch to add new rule to deny
  noisy setsockopt calls from systemd; (bnc#1196850).</changelog>
  <changelog author="nopower@suse.com" date="1649851200">- Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon
  which now will spawn new additional services on demand. We need to
  modify the existing smbd/winbind profiles and additionally add a
  new set of profiles to cater for the new functionality;
  (bnc#1198309);</changelog>
  <changelog author="suse-beta@cboltz.de" date="1650110400">- update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531)</changelog>
  <changelog author="dimstar@opensuse.org" date="1651060800">- Enhance zgrep-profile-mr870.diff to also allow/support zstd
  (boo#1198922).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1651233600">- add php8-fpm-mr876.patch so that php8 php-fpm can read its config
  (boo#1186267#c11)
- parser: add conflict with apparmor-utils &lt; 3.0 to avoid aa-status
  file conflict on upgrade (boo#1198958)
- utils: add missing dependency on apparmor-parser (boo#1198958#c4)</changelog>
  <changelog author="ddiss@suse.com" date="1661515200">- add profiles-permit-php-fpm-pid-files-directly-under-run.patch
  https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344)</changelog>
  <changelog author="scabrero@suse.de" date="1671796800">- Add samba-4-17.patch to update the samba profiles for samba
  version 4.17 (bsc#1206626);</changelog>
  <changelog author="ddiss@suse.com" date="1690286400">- Add pam_apparmor README, referenced from online cha-apparmor-pam.html
  documentation (bsc#1213472)</changelog>
  <changelog author="ddiss@suse.com" date="1693915200">- update zgrep profile to allow egrep helper use (bsc#1214458)
  - zgrep-profile-sync-with-master.diff</changelog>
  <changelog author="ddiss@suse.com" date="1695643200">- Fix pam_apparmor %post and %postun scripts to handle pam-config errors
  (bsc#1215596)</changelog>
</package>
<package pkgid="470552e86847a963ea85115ac919f61e89abd2d551a13b9f858aa220998f15a1" name="apparmor-parser" arch="aarch64">
  <version epoch="0" ver="3.0.4" rel="150500.11.9.1"/>
  <changelog author="suse-beta@cboltz.de" date="1634299200">- add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1636459200">- add aa-notify-more-arch-mr809.diff: Add support for reading s390x
  and aarch64 wtmp files (boo#1181155)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1639915200">- add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and
  /etc/ssl/engines.d/ in abstractions/openssl which were introduced
  with the latest openssl update</changelog>
  <changelog author="nopower@suse.com" date="1640001600">-  Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED
  operation="file_mmap" violation in SLE15-SP4; (bsc#1192336).</changelog>
  <changelog author="scabrero@suse.de" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb (bsc#1192684).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1643198400">- add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221,
  MR 827)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1644494400">- update to AppArmor 3.0.4
  - various fixes in profiles, abstractions, apparmor_parser and utils
    (some of them were already included as patches)
  - add support for mctp address family
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4
    for the full upstream changelog
- remove upstream(ed) patches:
  - aa-notify-more-arch-mr809.diff
  - ruby-3.1-build-fix.diff
  - add-samba-bgqd.diff
  - openssl-engdef-mr818.diff
  - profiles-python-3.10-mr783.diff
  - update-samba-abstractions-ldb2.diff
- refresh patches:
  - apparmor-samba-include-permissions-for-shares.diff
  - ruby-2_0-mkmf-destdir.patch</changelog>
  <changelog author="nopower@suse.com" date="1648123200">- Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1648555200">- ensure precompiled cache files are newer than (text) profiles
- reload profiles in %posttrans instead of %post to ensure both
  - profiles and -abstractons package are updated before the cache
  in /var/cache/apparmor/ gets built (boo#1195463 #c20)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1649592000">- add profile for zgrep and xzgrep to prevent CVE-2022-1271
  (zgrep-profile-mr870.diff)</changelog>
  <changelog author="nopower@suse.com" date="1649678400">- Add samba_deny_net_admin.patch to add new rule to deny
  noisy setsockopt calls from systemd; (bnc#1196850).</changelog>
  <changelog author="nopower@suse.com" date="1649851200">- Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon
  which now will spawn new additional services on demand. We need to
  modify the existing smbd/winbind profiles and additionally add a
  new set of profiles to cater for the new functionality;
  (bnc#1198309);</changelog>
  <changelog author="suse-beta@cboltz.de" date="1650110400">- update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531)</changelog>
  <changelog author="dimstar@opensuse.org" date="1651060800">- Enhance zgrep-profile-mr870.diff to also allow/support zstd
  (boo#1198922).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1651233600">- add php8-fpm-mr876.patch so that php8 php-fpm can read its config
  (boo#1186267#c11)
- parser: add conflict with apparmor-utils &lt; 3.0 to avoid aa-status
  file conflict on upgrade (boo#1198958)
- utils: add missing dependency on apparmor-parser (boo#1198958#c4)</changelog>
  <changelog author="ddiss@suse.com" date="1661515200">- add profiles-permit-php-fpm-pid-files-directly-under-run.patch
  https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344)</changelog>
  <changelog author="scabrero@suse.de" date="1671796800">- Add samba-4-17.patch to update the samba profiles for samba
  version 4.17 (bsc#1206626);</changelog>
  <changelog author="ddiss@suse.com" date="1690286400">- Add pam_apparmor README, referenced from online cha-apparmor-pam.html
  documentation (bsc#1213472)</changelog>
  <changelog author="ddiss@suse.com" date="1693915200">- update zgrep profile to allow egrep helper use (bsc#1214458)
  - zgrep-profile-sync-with-master.diff</changelog>
  <changelog author="ddiss@suse.com" date="1695643200">- Fix pam_apparmor %post and %postun scripts to handle pam-config errors
  (bsc#1215596)</changelog>
</package>
<package pkgid="d58485cab64f93e2f28042260e6de1ecd0f011e132b66e4984de5025d630f534" name="apparmor-parser" arch="s390x">
  <version epoch="0" ver="3.0.4" rel="150500.11.9.1"/>
  <changelog author="suse-beta@cboltz.de" date="1634299200">- add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1636459200">- add aa-notify-more-arch-mr809.diff: Add support for reading s390x
  and aarch64 wtmp files (boo#1181155)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1639915200">- add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and
  /etc/ssl/engines.d/ in abstractions/openssl which were introduced
  with the latest openssl update</changelog>
  <changelog author="nopower@suse.com" date="1640001600">-  Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED
  operation="file_mmap" violation in SLE15-SP4; (bsc#1192336).</changelog>
  <changelog author="scabrero@suse.de" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb (bsc#1192684).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1643198400">- add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221,
  MR 827)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1644494400">- update to AppArmor 3.0.4
  - various fixes in profiles, abstractions, apparmor_parser and utils
    (some of them were already included as patches)
  - add support for mctp address family
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4
    for the full upstream changelog
- remove upstream(ed) patches:
  - aa-notify-more-arch-mr809.diff
  - ruby-3.1-build-fix.diff
  - add-samba-bgqd.diff
  - openssl-engdef-mr818.diff
  - profiles-python-3.10-mr783.diff
  - update-samba-abstractions-ldb2.diff
- refresh patches:
  - apparmor-samba-include-permissions-for-shares.diff
  - ruby-2_0-mkmf-destdir.patch</changelog>
  <changelog author="nopower@suse.com" date="1648123200">- Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1648555200">- ensure precompiled cache files are newer than (text) profiles
- reload profiles in %posttrans instead of %post to ensure both
  - profiles and -abstractons package are updated before the cache
  in /var/cache/apparmor/ gets built (boo#1195463 #c20)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1649592000">- add profile for zgrep and xzgrep to prevent CVE-2022-1271
  (zgrep-profile-mr870.diff)</changelog>
  <changelog author="nopower@suse.com" date="1649678400">- Add samba_deny_net_admin.patch to add new rule to deny
  noisy setsockopt calls from systemd; (bnc#1196850).</changelog>
  <changelog author="nopower@suse.com" date="1649851200">- Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon
  which now will spawn new additional services on demand. We need to
  modify the existing smbd/winbind profiles and additionally add a
  new set of profiles to cater for the new functionality;
  (bnc#1198309);</changelog>
  <changelog author="suse-beta@cboltz.de" date="1650110400">- update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531)</changelog>
  <changelog author="dimstar@opensuse.org" date="1651060800">- Enhance zgrep-profile-mr870.diff to also allow/support zstd
  (boo#1198922).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1651233600">- add php8-fpm-mr876.patch so that php8 php-fpm can read its config
  (boo#1186267#c11)
- parser: add conflict with apparmor-utils &lt; 3.0 to avoid aa-status
  file conflict on upgrade (boo#1198958)
- utils: add missing dependency on apparmor-parser (boo#1198958#c4)</changelog>
  <changelog author="ddiss@suse.com" date="1661515200">- add profiles-permit-php-fpm-pid-files-directly-under-run.patch
  https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344)</changelog>
  <changelog author="scabrero@suse.de" date="1671796800">- Add samba-4-17.patch to update the samba profiles for samba
  version 4.17 (bsc#1206626);</changelog>
  <changelog author="ddiss@suse.com" date="1690286400">- Add pam_apparmor README, referenced from online cha-apparmor-pam.html
  documentation (bsc#1213472)</changelog>
  <changelog author="ddiss@suse.com" date="1693915200">- update zgrep profile to allow egrep helper use (bsc#1214458)
  - zgrep-profile-sync-with-master.diff</changelog>
  <changelog author="ddiss@suse.com" date="1695643200">- Fix pam_apparmor %post and %postun scripts to handle pam-config errors
  (bsc#1215596)</changelog>
</package>
<package pkgid="cb6e1e489e875e8f2c87c24cfd9928c5f53931325c8eff88a7bc8d8c2a0c8207" name="apparmor-parser" arch="x86_64">
  <version epoch="0" ver="3.0.4" rel="150500.11.9.1"/>
  <changelog author="suse-beta@cboltz.de" date="1634299200">- add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1636459200">- add aa-notify-more-arch-mr809.diff: Add support for reading s390x
  and aarch64 wtmp files (boo#1181155)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1639915200">- add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and
  /etc/ssl/engines.d/ in abstractions/openssl which were introduced
  with the latest openssl update</changelog>
  <changelog author="nopower@suse.com" date="1640001600">-  Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED
  operation="file_mmap" violation in SLE15-SP4; (bsc#1192336).</changelog>
  <changelog author="scabrero@suse.de" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb (bsc#1192684).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1643198400">- add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221,
  MR 827)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1644494400">- update to AppArmor 3.0.4
  - various fixes in profiles, abstractions, apparmor_parser and utils
    (some of them were already included as patches)
  - add support for mctp address family
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4
    for the full upstream changelog
- remove upstream(ed) patches:
  - aa-notify-more-arch-mr809.diff
  - ruby-3.1-build-fix.diff
  - add-samba-bgqd.diff
  - openssl-engdef-mr818.diff
  - profiles-python-3.10-mr783.diff
  - update-samba-abstractions-ldb2.diff
- refresh patches:
  - apparmor-samba-include-permissions-for-shares.diff
  - ruby-2_0-mkmf-destdir.patch</changelog>
  <changelog author="nopower@suse.com" date="1648123200">- Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1648555200">- ensure precompiled cache files are newer than (text) profiles
- reload profiles in %posttrans instead of %post to ensure both
  - profiles and -abstractons package are updated before the cache
  in /var/cache/apparmor/ gets built (boo#1195463 #c20)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1649592000">- add profile for zgrep and xzgrep to prevent CVE-2022-1271
  (zgrep-profile-mr870.diff)</changelog>
  <changelog author="nopower@suse.com" date="1649678400">- Add samba_deny_net_admin.patch to add new rule to deny
  noisy setsockopt calls from systemd; (bnc#1196850).</changelog>
  <changelog author="nopower@suse.com" date="1649851200">- Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon
  which now will spawn new additional services on demand. We need to
  modify the existing smbd/winbind profiles and additionally add a
  new set of profiles to cater for the new functionality;
  (bnc#1198309);</changelog>
  <changelog author="suse-beta@cboltz.de" date="1650110400">- update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531)</changelog>
  <changelog author="dimstar@opensuse.org" date="1651060800">- Enhance zgrep-profile-mr870.diff to also allow/support zstd
  (boo#1198922).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1651233600">- add php8-fpm-mr876.patch so that php8 php-fpm can read its config
  (boo#1186267#c11)
- parser: add conflict with apparmor-utils &lt; 3.0 to avoid aa-status
  file conflict on upgrade (boo#1198958)
- utils: add missing dependency on apparmor-parser (boo#1198958#c4)</changelog>
  <changelog author="ddiss@suse.com" date="1661515200">- add profiles-permit-php-fpm-pid-files-directly-under-run.patch
  https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344)</changelog>
  <changelog author="scabrero@suse.de" date="1671796800">- Add samba-4-17.patch to update the samba profiles for samba
  version 4.17 (bsc#1206626);</changelog>
  <changelog author="ddiss@suse.com" date="1690286400">- Add pam_apparmor README, referenced from online cha-apparmor-pam.html
  documentation (bsc#1213472)</changelog>
  <changelog author="ddiss@suse.com" date="1693915200">- update zgrep profile to allow egrep helper use (bsc#1214458)
  - zgrep-profile-sync-with-master.diff</changelog>
  <changelog author="ddiss@suse.com" date="1695643200">- Fix pam_apparmor %post and %postun scripts to handle pam-config errors
  (bsc#1215596)</changelog>
</package>
<package pkgid="22554ae134eef62c1cc22c7e73ec058c96f22d882f9443fb0f451c40964430da" name="babeltrace" arch="aarch64">
  <version epoch="0" ver="1.5.8" rel="150300.3.2.1"/>
  <changelog author="tonyj@suse.com" date="1438084800">- Update to version 1.2.4 (FATE#319273)
  Changelog 1.2.4:
  * Fix: make sure we can exit the get_new_metadata loop
  * Docs fix: Change bt_ctf_writer_create_stream return description
  * Fix: offset_s and CTF clocks with frequency != 1GHz
  Changelog 1.2.3:
  * Fix: incorrect compiler warning
  * Fix: Don't assume that PROT_WRITE grants read permissions
  * Fix: align objstack on 8 bytes
  * Fix Python: Add a comment warning about an API limitation
  * Use BABELTRACE_HOST_NAME_MAX in test_ctf_writer.c
  * Add limits compatibility header
  * Fix: don't perform unaligned integer read/writes
  * Fix: Align buffers from objstack_alloc on sizeof(void *)
  * Fix: bt_ctf_field_type_structure_add_field argument validation
  Changelog 1.2.2:
  * Fix: Support out of tree builds in babeltrace
  * Fix: mmap trace read the stream_id from the first packet
  * Fix: check the lttng-relayd protocol version
  * Fix: don't update the trace collection if no new streams were received
  * Fix (Python bindings): Return a string if a sequence's element are chars
  * Fix: don't use a return code in _bt_ctf_stream_append_discarded_events
  * Fix: Report the sequence's length field's value as length
  * Fix: Variable name typo in SequenceField and Event classes
  * Fix python: remove weird char at the end of line
  * Fix: add missing files to gitignore
  * Fix: ctf-text: add missing double-quotes around enum tag
  * Fix: Add missing lttng_live_should_quit checks
  * Fix: Report errors occuring in lttng_live_read</changelog>
  <changelog author="dmueller@suse.com" date="1441022400">- enable build for aarch64 (fate#318370)</changelog>
  <changelog author="tonyj@suse.com" date="1444046400">- Cleanup urls in spec file (FATE#319273)</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1470139200">- add ppc64/ppc64le in ExclusiveArch</changelog>
  <changelog author="tonyj@suse.com" date="1504267200">- Update to version 1.5.3 for SLE15 (bsc#1055683)</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1509710400">- Disable static library build.
- Enable Python 3 bindings build.
- Remove explicit glib2-devel requirement for the devel package: is
  autodetected already.
- Spec cleanup.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1521115200">- Update to version 1.5.4:
  * Use signed accessors for clock offsets.
  * Fix a signedness error in python complements.
  * Handle packet_seek errors.
  * Prevent calling adding the same trace recursively.
  * Make sure we have all the metadata streams before adding new
    traces.
  * Add missing debugging information in the live plugin.
  * Set stream id in HUP case.
  * Use list rather than ptr array for trace streams.
  * Fix a leak of streams.
  * Handle 0 session case in ask new streams.
  * Break loop on getting metadata error.
  * Return error on ask_new_stream when should quit.
  * Don't access missing ctf trace when getting metadata.
  * Fix lttng-live discarded event count after inactivity.
  * Fix timegm compat on Solaris.
  * Fix Python bindings when building with PIE hardening.
  * lttng-live: Print discarded event and packet lost warnings on
    stderr.</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1529236800">- Update to version 1.5.5:
  * Propagate error from packet_seek in case of truncated packet.
  * Fix: report truncated files while reading.
- Use tarball signing.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1542196800">- Update to version 1.5.6:
  * Fix: remove left-over debug logging statement.
  * Use trace-&gt;trace_id in check to remove trace from bt_ctx.
  * Fix: missing initializer braces warning.
  * Fix: zero out URL parsing array before use and ensure proper
    error reporting.</changelog>
  <changelog author="azouhr@opensuse.org" date="1563192000">- add s390x in ExclusiveArch</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1582718400">- Update to version 1.5.8 (changes since 1.5.6):
  * Cleanup: bitfields: streamline use of underscores.
  * Fix: bitfield: shift undefined/implementation defined
    behaviours.
  * Fix: array and sequence field's 'elems' members can be left NULL.
  * Fix: invalid alignment of enumeration fields.
  * Fix: lttng-live format: do not error out on empty streams
    hang up.
  * Fix: lttng-live: ctf_live_packet_seek stream hang up handling.
  * Fix: lib/iterator.c: unbalanced ctx put (leak).
  * Fix: lttng-live: lttng_live_open_trace_read memory leak.
  * Fix: trace-collection: trace clock use after free.
  * Fix: lttng-live: use-after-free in get_next_index().
  * Do not use diagnostic pragma when GCC version is lower than
    4.6.0.
  * Missing define when not building with gcc.
- Drop support for old openSUSE versions.</changelog>
  <changelog author="schwab@suse.de" date="1598875200">- Add riscv64 to ExclusiveArch</changelog>
</package>
<package pkgid="c76007e1a3b1cda3a4ca502a18383bccf4a769c8a9905c6e19681fc0e695096d" name="babeltrace" arch="src">
  <version epoch="0" ver="1.5.8" rel="150300.3.2.1"/>
  <changelog author="tonyj@suse.com" date="1335873600">- Update to version 1.0.0-rc2</changelog>
  <changelog author="tonyj@suse.com" date="1338811200">- Update to version 1.0.0-rc4</changelog>
  <changelog author="tonyj@suse.com" date="1363003200">- Upgrade to version 1.0.3 (FATE#314846)
  Changelog 1.0.3:
  * Fix: Double free when calling bt_context_remove_trace()
  * Add missing runall.sh to dist packaging
  * Fix: alignment of compound types containing array field
  Changelog 1.0.2:
  * Fix: add tests/lib missing files to Makefile.am
  Changelog 1.0.1:
  * Provides a basic pkg-config file for libbabeltrace
  * Fix erroneous warning/error messages
  * Fix comment in context.h
  * Cleanup: Remove whitespace at EOL from mit-license.txt
  * Add missing permission notice in each source file
  * Adding a test which do a sequence of seek BEGIN, LAST, BEGIN, LAST
  * Run seek tests on a second trace file
  * Add #define _GNU_SOURCE to remove warning about asprintf
  * Include a test for SEEK_BEGIN and SEEK_LAST
  * Fix: Report success even if we find at least one valid stream in find_max_timestamp_ctf_stream_class
  * Fix SEEK_BEGIN for streams that do not contain any event
  Changelog 1.0.0:
  * tests: add test traces to distribution tarball
  * Document bash requirement for make check in README
  * Add tests to make check
  * Fix: add missing header size validation
  * callbacks.c: handle extract_ctf_stream_event return value
  * Cleanup: fix cppcheck warning
  * Cleanup: fix cppcheck warnings
  * fix double-free on error path
  Changelog 1.0.0-rc6:
  * Add valgrind suppression file for libpopt
  * Fix: unplug memory leak that causes popt-0.13 to segfault
  * Fix: test all close/fclose ret val, fix double close
  * Cleanup: add missing newline
  * Fix: fd leak on trace close
  * Fix memory leaks induced by lack of libpopt documentation
  * babeltrace: fix poptGetOptArg memleak
  * plugins: implement plugin unregister
  * Doc: valgrind with babeltrace (glib workaround)
  * callsites: fix memory leak
  * Fix: free all the metadata-related memory
  * Fix : Free the iterator callback arrays
  * Fix : cleanup teardown of context
  * Fix : protect static float and double declarations
  * callsite: support instruction pointer field
  * Document that list.h is LGPLv2.1, but entirely trivial
  * Fix: callsite support: list multiple callsites
  * Add callsite support
  * Fix: Allow 64-bit packet offset
  * Fix: emf uri: surround by " "
  * Handle model.emf.uri event info
  * Fix: Documentation cleanup
  * Fix: misplaced C++ ifdef
  * Fix babeltrace-log get big line when the input file last line don't have enter
  * API Fix: bt_ctf_iter_read_event_flags
  * Fix: get encoding for char arrays and sequences
  * Fix: access to declaration from declaration_field
  * Fix: get_declaration_* should not cast to field
  * Fix babeltrace-log uninitialized memory (v2)
  * Revert "Fix babeltrace-log uninitialized memory"
  * Fix babeltrace-log uninitialized memory
  * Fix: access field properties by declaration
  * Fix: check return value of get_char_array
  * Fix: C++ support to API header files
  Changelog 1.0.0-rc5:
  * Change default printout to add host, process names and vpid
  * Add support for trace:hostname field
  * Fix: allow specifying more than one input trace path
  * Fix: make warnings (partial errors) visible
  * Fix: --clock-force-correlate to handle trace collections gathered from v
  * Documentation: update API doc with enum functions
  * Fix: API: remove unsupported BT_SEEK_END from API
  * API documentation
  * Cleanup: shut up gcc uninitialized var warning
  * Fix: support large files on 32-bit systems
  * Fix: remove unused fts.h include
  * Fix: add missing enum support to API
  * Fix: handle clock offset with frequency different from 1GHz
  * Cleanup: update ifdef wrapper name
  * Fix: clarify bt_ctf_get_field_list
  * Fix trace-collection.h: No such file or directory that build code with l
  * Fix: check return value of bt_context_create
  * Fix: ensure mmap_base_offset is zeroed on initialization
  * Fix: Reswitch to FTW for add_traces_recursive
  * Fix: don't free unallocated index
  * Fix: don't close the metadata FD if a FP is passed
  * Add BT_SEEK_LAST type to bt_iter_pos
  * Fix: iterator.c BT_SEEK_RESTORE: check return value
  * Fix: complete error handling of babeltrace API
  * cleanup: protected -&gt; hidden: cleanup symbol table
  * Fix: add mmap_base_offset to ctf_stream_pos
  * Fix: assign the current clock for mmap traces
  * Fix: libbabeltrace add missing static declaration
  * Fix: safety checks for opening mmap traces
  * Remove trace-collection.h from include_headers
  * Fix: protect visibility of ctf-parser functions
  * Fix: correct name of bt_ctf_field_get_error in comments and typo in man
  * Fix: wrong type in bt_ctf_get_uint64/int64
  * API cleanup name get_timestamp and get_cycles
  * fix comment struct bt_saved_pos
  * Fix: Add missing clock-types.h
  * Get rid of clock-raw and use real clock
  * Cleanup (messages): Make the wording of the signedness warning clearer
  * Fix: error path if heap_init fails
  * Fix: Remove obsolete bt_iter_seek function
  * Make the signedness warning useful with the field name
  * Fix: Restore heap for SEEK_BEGIN
  * Fix: check if handle is valid
  * Fix: iterator set_pos
  * Fix: get rid of consumed flag
  * Fix: add missing heap_copy
  * Fix: babeltrace assert() triggered by directories within trace
  * Several fixes for bt_iter_pos related functions
  * Fix iterator: various fixes
  * Fix: remove duplicate yydebug var
  * Fix babeltrace iterator lib: seek at time 0</changelog>
  <changelog author="cfarrell@suse.com" date="1363348800">- license update: MIT and GPL-2.0
  The correct operator is ^and^, not ^or^. Also, use SPDX format where
  possible</changelog>
  <changelog author="tonyj@suse.com" date="1392033600">- Update to version 1.1.1</changelog>
  <changelog author="tonyj@suse.com" date="1393588800">- Update to version 1.2</changelog>
  <changelog author="tonyj@suse.com" date="1397563200">- Update to version 1.2.1
  Changelog:
  * Fix: Accept an input port in the live URL when no session is provided</changelog>
  <changelog author="tonyj@suse.com" date="1438084800">- Update to version 1.2.4 (FATE#319273)
  Changelog 1.2.4:
  * Fix: make sure we can exit the get_new_metadata loop
  * Docs fix: Change bt_ctf_writer_create_stream return description
  * Fix: offset_s and CTF clocks with frequency != 1GHz
  Changelog 1.2.3:
  * Fix: incorrect compiler warning
  * Fix: Don't assume that PROT_WRITE grants read permissions
  * Fix: align objstack on 8 bytes
  * Fix Python: Add a comment warning about an API limitation
  * Use BABELTRACE_HOST_NAME_MAX in test_ctf_writer.c
  * Add limits compatibility header
  * Fix: don't perform unaligned integer read/writes
  * Fix: Align buffers from objstack_alloc on sizeof(void *)
  * Fix: bt_ctf_field_type_structure_add_field argument validation
  Changelog 1.2.2:
  * Fix: Support out of tree builds in babeltrace
  * Fix: mmap trace read the stream_id from the first packet
  * Fix: check the lttng-relayd protocol version
  * Fix: don't update the trace collection if no new streams were received
  * Fix (Python bindings): Return a string if a sequence's element are chars
  * Fix: don't use a return code in _bt_ctf_stream_append_discarded_events
  * Fix: Report the sequence's length field's value as length
  * Fix: Variable name typo in SequenceField and Event classes
  * Fix python: remove weird char at the end of line
  * Fix: add missing files to gitignore
  * Fix: ctf-text: add missing double-quotes around enum tag
  * Fix: Add missing lttng_live_should_quit checks
  * Fix: Report errors occuring in lttng_live_read</changelog>
  <changelog author="dmueller@suse.com" date="1441022400">- enable build for aarch64 (fate#318370)</changelog>
  <changelog author="tonyj@suse.com" date="1444046400">- Cleanup urls in spec file (FATE#319273)</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1470139200">- add ppc64/ppc64le in ExclusiveArch</changelog>
  <changelog author="tonyj@suse.com" date="1504267200">- Update to version 1.5.3 for SLE15 (bsc#1055683)</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1509710400">- Disable static library build.
- Enable Python 3 bindings build.
- Remove explicit glib2-devel requirement for the devel package: is
  autodetected already.
- Spec cleanup.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1521115200">- Update to version 1.5.4:
  * Use signed accessors for clock offsets.
  * Fix a signedness error in python complements.
  * Handle packet_seek errors.
  * Prevent calling adding the same trace recursively.
  * Make sure we have all the metadata streams before adding new
    traces.
  * Add missing debugging information in the live plugin.
  * Set stream id in HUP case.
  * Use list rather than ptr array for trace streams.
  * Fix a leak of streams.
  * Handle 0 session case in ask new streams.
  * Break loop on getting metadata error.
  * Return error on ask_new_stream when should quit.
  * Don't access missing ctf trace when getting metadata.
  * Fix lttng-live discarded event count after inactivity.
  * Fix timegm compat on Solaris.
  * Fix Python bindings when building with PIE hardening.
  * lttng-live: Print discarded event and packet lost warnings on
    stderr.</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1529236800">- Update to version 1.5.5:
  * Propagate error from packet_seek in case of truncated packet.
  * Fix: report truncated files while reading.
- Use tarball signing.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1542196800">- Update to version 1.5.6:
  * Fix: remove left-over debug logging statement.
  * Use trace-&gt;trace_id in check to remove trace from bt_ctx.
  * Fix: missing initializer braces warning.
  * Fix: zero out URL parsing array before use and ensure proper
    error reporting.</changelog>
  <changelog author="azouhr@opensuse.org" date="1563192000">- add s390x in ExclusiveArch</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1582718400">- Update to version 1.5.8 (changes since 1.5.6):
  * Cleanup: bitfields: streamline use of underscores.
  * Fix: bitfield: shift undefined/implementation defined
    behaviours.
  * Fix: array and sequence field's 'elems' members can be left NULL.
  * Fix: invalid alignment of enumeration fields.
  * Fix: lttng-live format: do not error out on empty streams
    hang up.
  * Fix: lttng-live: ctf_live_packet_seek stream hang up handling.
  * Fix: lib/iterator.c: unbalanced ctx put (leak).
  * Fix: lttng-live: lttng_live_open_trace_read memory leak.
  * Fix: trace-collection: trace clock use after free.
  * Fix: lttng-live: use-after-free in get_next_index().
  * Do not use diagnostic pragma when GCC version is lower than
    4.6.0.
  * Missing define when not building with gcc.
- Drop support for old openSUSE versions.</changelog>
  <changelog author="schwab@suse.de" date="1598875200">- Add riscv64 to ExclusiveArch</changelog>
</package>
<package pkgid="eab1117bf3acef697c4adbd2d22859cf4d2c52fb705bdd0ec0eaa6fbbc3cadda" name="babeltrace" arch="x86_64">
  <version epoch="0" ver="1.5.8" rel="150300.3.2.1"/>
  <changelog author="tonyj@suse.com" date="1438084800">- Update to version 1.2.4 (FATE#319273)
  Changelog 1.2.4:
  * Fix: make sure we can exit the get_new_metadata loop
  * Docs fix: Change bt_ctf_writer_create_stream return description
  * Fix: offset_s and CTF clocks with frequency != 1GHz
  Changelog 1.2.3:
  * Fix: incorrect compiler warning
  * Fix: Don't assume that PROT_WRITE grants read permissions
  * Fix: align objstack on 8 bytes
  * Fix Python: Add a comment warning about an API limitation
  * Use BABELTRACE_HOST_NAME_MAX in test_ctf_writer.c
  * Add limits compatibility header
  * Fix: don't perform unaligned integer read/writes
  * Fix: Align buffers from objstack_alloc on sizeof(void *)
  * Fix: bt_ctf_field_type_structure_add_field argument validation
  Changelog 1.2.2:
  * Fix: Support out of tree builds in babeltrace
  * Fix: mmap trace read the stream_id from the first packet
  * Fix: check the lttng-relayd protocol version
  * Fix: don't update the trace collection if no new streams were received
  * Fix (Python bindings): Return a string if a sequence's element are chars
  * Fix: don't use a return code in _bt_ctf_stream_append_discarded_events
  * Fix: Report the sequence's length field's value as length
  * Fix: Variable name typo in SequenceField and Event classes
  * Fix python: remove weird char at the end of line
  * Fix: add missing files to gitignore
  * Fix: ctf-text: add missing double-quotes around enum tag
  * Fix: Add missing lttng_live_should_quit checks
  * Fix: Report errors occuring in lttng_live_read</changelog>
  <changelog author="dmueller@suse.com" date="1441022400">- enable build for aarch64 (fate#318370)</changelog>
  <changelog author="tonyj@suse.com" date="1444046400">- Cleanup urls in spec file (FATE#319273)</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1470139200">- add ppc64/ppc64le in ExclusiveArch</changelog>
  <changelog author="tonyj@suse.com" date="1504267200">- Update to version 1.5.3 for SLE15 (bsc#1055683)</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1509710400">- Disable static library build.
- Enable Python 3 bindings build.
- Remove explicit glib2-devel requirement for the devel package: is
  autodetected already.
- Spec cleanup.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1521115200">- Update to version 1.5.4:
  * Use signed accessors for clock offsets.
  * Fix a signedness error in python complements.
  * Handle packet_seek errors.
  * Prevent calling adding the same trace recursively.
  * Make sure we have all the metadata streams before adding new
    traces.
  * Add missing debugging information in the live plugin.
  * Set stream id in HUP case.
  * Use list rather than ptr array for trace streams.
  * Fix a leak of streams.
  * Handle 0 session case in ask new streams.
  * Break loop on getting metadata error.
  * Return error on ask_new_stream when should quit.
  * Don't access missing ctf trace when getting metadata.
  * Fix lttng-live discarded event count after inactivity.
  * Fix timegm compat on Solaris.
  * Fix Python bindings when building with PIE hardening.
  * lttng-live: Print discarded event and packet lost warnings on
    stderr.</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1529236800">- Update to version 1.5.5:
  * Propagate error from packet_seek in case of truncated packet.
  * Fix: report truncated files while reading.
- Use tarball signing.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1542196800">- Update to version 1.5.6:
  * Fix: remove left-over debug logging statement.
  * Use trace-&gt;trace_id in check to remove trace from bt_ctx.
  * Fix: missing initializer braces warning.
  * Fix: zero out URL parsing array before use and ensure proper
    error reporting.</changelog>
  <changelog author="azouhr@opensuse.org" date="1563192000">- add s390x in ExclusiveArch</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1582718400">- Update to version 1.5.8 (changes since 1.5.6):
  * Cleanup: bitfields: streamline use of underscores.
  * Fix: bitfield: shift undefined/implementation defined
    behaviours.
  * Fix: array and sequence field's 'elems' members can be left NULL.
  * Fix: invalid alignment of enumeration fields.
  * Fix: lttng-live format: do not error out on empty streams
    hang up.
  * Fix: lttng-live: ctf_live_packet_seek stream hang up handling.
  * Fix: lib/iterator.c: unbalanced ctx put (leak).
  * Fix: lttng-live: lttng_live_open_trace_read memory leak.
  * Fix: trace-collection: trace clock use after free.
  * Fix: lttng-live: use-after-free in get_next_index().
  * Do not use diagnostic pragma when GCC version is lower than
    4.6.0.
  * Missing define when not building with gcc.
- Drop support for old openSUSE versions.</changelog>
  <changelog author="schwab@suse.de" date="1598875200">- Add riscv64 to ExclusiveArch</changelog>
</package>
<package pkgid="ecd39335e529476b669e0946e9bff81c6947dff69ab687ff3f7b8e40341ef55c" name="cloud-netconfig-azure" arch="noarch">
  <version epoch="0" ver="1.8" rel="150000.25.11.1"/>
  <changelog author="rjschwei@suse.com" date="1507723200">- Update to version 0.5
  + New API version for Azure metadata server
  + Wait for the metadata server in EC2</changelog>
  <changelog author="jgleissner@suse.com" date="1507896000">- Update to version 0.6:
  + Use tested and supported metadata API versions</changelog>
  <changelog author="jgleissner@suse.com" date="1507896001">- Prepare for SLE11 submission (bsc#1063292)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1510228800">- Add missing Provides/Conflicts statements to spec file</changelog>
  <changelog author="jgleissner@suse.com" date="1515758400">- Remove dependency on udev-persistent-ifnames (bsc#1075484)</changelog>
  <changelog author="jgleissner@suse.com" date="1516190400">- Added dependency on curl
- Use otherproviders() only on SLES 11 builds</changelog>
  <changelog author="jgleissner@suse.com" date="1527854400">- Update to version 0.7:
  + no persistent interface names in Azure (bsc#1095485)</changelog>
  <changelog author="jgleissner@suse.com" date="1548936000">- Update to version 0.9:
  + run cloud-netconfig periodically (bsc#1118783 bsc#1122013)
  + do not treat eth0 special wrt routing policies (bsc#1123008)
  + reduce timeout on metadata read (bsc#1112822)</changelog>
  <changelog author="jgleissner@suse.com" date="1558008000">- Update to version 1.0:
  + pause and retry if API call throttling is detected in Azure
    (bsc#1135257 bsc#1135263)</changelog>
  <changelog author="jgleissner@suse.com" date="1574337600">- Update to version 1.1
  + fix use of GATEWAY variable (bsc#1157117, bsc#1157190)
  + remove secondary IPv4 address only when added by cloud-netconfig
    (bsc#1144282)
  + simplify routing setup for single NIC systems (partly fixes
    bsc#1135592)</changelog>
  <changelog author="jgleissner@suse.com" date="1574769600">- Update to version 1.2:
  + support AWS IMDSv2 token</changelog>
  <changelog author="jgleissner@suse.com" date="1574769601">- Update to version 1.3:
  + Fix IPv4 address handling on secondary NICs in Azure</changelog>
  <changelog author="jgleissner@suse.com" date="1574942400">- Removed obsolete Group tag from spec file</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="jgleissner@suse.com" date="1580817600">- Update to version 1.4:
  + copy routes from default routing table (bsc#1162705, bsc#1162707)
  + make CLOUD_NETCONFIG_MANAGE default configurable</changelog>
  <changelog author="jgleissner@suse.com" date="1604577600">- Update to version 1.5:
  + Add support for GCE (bsc#1159460, bsc#1178486)
  + Improve default gateway determination</changelog>
  <changelog author="jgleissner@suse.com" date="1630065600">- Update to version 1.6:
  + Ignore proxy when accessing metadata (bsc#1187939)
  + Print warning in case metadata is not accessible
  + Documentation update</changelog>
  <changelog author="suse-beta@cboltz.de" date="1663502400">- /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in
  Tumbleweed, update path (poo#116221)</changelog>
  <changelog author="jgleissner@suse.com" date="1671192000">- Update to version 1.7:
  + Overhaul policy routing setup (issue #19)
  + Support alias IPv4 ranges (issue #14)
  + Add support for NetworkManager (bsc#1204549)
  + Remove dependency on netconfig
  + Install into libexec directory
  + Clear stale ifcfg files for accelerated NICs (bsc#1199853)
  + More debug messages
  + Documentation update</changelog>
  <changelog author="jgleissner@suse.com" date="1693396800">- Update to version 1.8:
  + Fix Azure metadata check (bsc#1214715)
  + Fix cleanup on ifdown</changelog>
</package>
<package pkgid="8d233dda3e49f4e333a5f5294c3b48e43fa5034d6e0d3565b283b850033c59b4" name="cloud-netconfig-azure" arch="src">
  <version epoch="0" ver="1.8" rel="150000.25.11.1"/>
  <changelog author="rjschwei@suse.com" date="1507723200">- Update to version 0.5
  + New API version for Azure metadata server
  + Wait for the metadata server in EC2</changelog>
  <changelog author="jgleissner@suse.com" date="1507896000">- Update to version 0.6:
  + Use tested and supported metadata API versions</changelog>
  <changelog author="jgleissner@suse.com" date="1507896001">- Prepare for SLE11 submission (bsc#1063292)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1510228800">- Add missing Provides/Conflicts statements to spec file</changelog>
  <changelog author="jgleissner@suse.com" date="1515758400">- Remove dependency on udev-persistent-ifnames (bsc#1075484)</changelog>
  <changelog author="jgleissner@suse.com" date="1516190400">- Added dependency on curl
- Use otherproviders() only on SLES 11 builds</changelog>
  <changelog author="jgleissner@suse.com" date="1527854400">- Update to version 0.7:
  + no persistent interface names in Azure (bsc#1095485)</changelog>
  <changelog author="jgleissner@suse.com" date="1548936000">- Update to version 0.9:
  + run cloud-netconfig periodically (bsc#1118783 bsc#1122013)
  + do not treat eth0 special wrt routing policies (bsc#1123008)
  + reduce timeout on metadata read (bsc#1112822)</changelog>
  <changelog author="jgleissner@suse.com" date="1558008000">- Update to version 1.0:
  + pause and retry if API call throttling is detected in Azure
    (bsc#1135257 bsc#1135263)</changelog>
  <changelog author="jgleissner@suse.com" date="1574337600">- Update to version 1.1
  + fix use of GATEWAY variable (bsc#1157117, bsc#1157190)
  + remove secondary IPv4 address only when added by cloud-netconfig
    (bsc#1144282)
  + simplify routing setup for single NIC systems (partly fixes
    bsc#1135592)</changelog>
  <changelog author="jgleissner@suse.com" date="1574769600">- Update to version 1.2:
  + support AWS IMDSv2 token</changelog>
  <changelog author="jgleissner@suse.com" date="1574769601">- Update to version 1.3:
  + Fix IPv4 address handling on secondary NICs in Azure</changelog>
  <changelog author="jgleissner@suse.com" date="1574942400">- Removed obsolete Group tag from spec file</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="jgleissner@suse.com" date="1580817600">- Update to version 1.4:
  + copy routes from default routing table (bsc#1162705, bsc#1162707)
  + make CLOUD_NETCONFIG_MANAGE default configurable</changelog>
  <changelog author="jgleissner@suse.com" date="1604577600">- Update to version 1.5:
  + Add support for GCE (bsc#1159460, bsc#1178486)
  + Improve default gateway determination</changelog>
  <changelog author="jgleissner@suse.com" date="1630065600">- Update to version 1.6:
  + Ignore proxy when accessing metadata (bsc#1187939)
  + Print warning in case metadata is not accessible
  + Documentation update</changelog>
  <changelog author="suse-beta@cboltz.de" date="1663502400">- /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in
  Tumbleweed, update path (poo#116221)</changelog>
  <changelog author="jgleissner@suse.com" date="1671192000">- Update to version 1.7:
  + Overhaul policy routing setup (issue #19)
  + Support alias IPv4 ranges (issue #14)
  + Add support for NetworkManager (bsc#1204549)
  + Remove dependency on netconfig
  + Install into libexec directory
  + Clear stale ifcfg files for accelerated NICs (bsc#1199853)
  + More debug messages
  + Documentation update</changelog>
  <changelog author="jgleissner@suse.com" date="1693396800">- Update to version 1.8:
  + Fix Azure metadata check (bsc#1214715)
  + Fix cleanup on ifdown</changelog>
</package>
<package pkgid="e2f1f16da1088410353e046e1582a29f3852a1af3ac66c25b89c60c8177b0fcb" name="cloud-netconfig-ec2" arch="noarch">
  <version epoch="0" ver="1.8" rel="150000.25.11.1"/>
  <changelog author="rjschwei@suse.com" date="1507723200">- Update to version 0.5
  + New API version for Azure metadata server
  + Wait for the metadata server in EC2</changelog>
  <changelog author="jgleissner@suse.com" date="1507896000">- Update to version 0.6:
  + Use tested and supported metadata API versions</changelog>
  <changelog author="jgleissner@suse.com" date="1507896001">- Prepare for SLE11 submission (bsc#1063292)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1510228800">- Add missing Provides/Conflicts statements to spec file</changelog>
  <changelog author="jgleissner@suse.com" date="1515758400">- Remove dependency on udev-persistent-ifnames (bsc#1075484)</changelog>
  <changelog author="jgleissner@suse.com" date="1516190400">- Added dependency on curl
- Use otherproviders() only on SLES 11 builds</changelog>
  <changelog author="jgleissner@suse.com" date="1527854400">- Update to version 0.7:
  + no persistent interface names in Azure (bsc#1095485)</changelog>
  <changelog author="jgleissner@suse.com" date="1548936000">- Update to version 0.9:
  + run cloud-netconfig periodically (bsc#1118783 bsc#1122013)
  + do not treat eth0 special wrt routing policies (bsc#1123008)
  + reduce timeout on metadata read (bsc#1112822)</changelog>
  <changelog author="jgleissner@suse.com" date="1558008000">- Update to version 1.0:
  + pause and retry if API call throttling is detected in Azure
    (bsc#1135257 bsc#1135263)</changelog>
  <changelog author="jgleissner@suse.com" date="1574337600">- Update to version 1.1
  + fix use of GATEWAY variable (bsc#1157117, bsc#1157190)
  + remove secondary IPv4 address only when added by cloud-netconfig
    (bsc#1144282)
  + simplify routing setup for single NIC systems (partly fixes
    bsc#1135592)</changelog>
  <changelog author="jgleissner@suse.com" date="1574769600">- Update to version 1.2:
  + support AWS IMDSv2 token</changelog>
  <changelog author="jgleissner@suse.com" date="1574769601">- Update to version 1.3:
  + Fix IPv4 address handling on secondary NICs in Azure</changelog>
  <changelog author="jgleissner@suse.com" date="1574942400">- Removed obsolete Group tag from spec file</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="jgleissner@suse.com" date="1580817600">- Update to version 1.4:
  + copy routes from default routing table (bsc#1162705, bsc#1162707)
  + make CLOUD_NETCONFIG_MANAGE default configurable</changelog>
  <changelog author="jgleissner@suse.com" date="1604577600">- Update to version 1.5:
  + Add support for GCE (bsc#1159460, bsc#1178486)
  + Improve default gateway determination</changelog>
  <changelog author="jgleissner@suse.com" date="1630065600">- Update to version 1.6:
  + Ignore proxy when accessing metadata (bsc#1187939)
  + Print warning in case metadata is not accessible
  + Documentation update</changelog>
  <changelog author="suse-beta@cboltz.de" date="1663502400">- /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in
  Tumbleweed, update path (poo#116221)</changelog>
  <changelog author="jgleissner@suse.com" date="1671192000">- Update to version 1.7:
  + Overhaul policy routing setup (issue #19)
  + Support alias IPv4 ranges (issue #14)
  + Add support for NetworkManager (bsc#1204549)
  + Remove dependency on netconfig
  + Install into libexec directory
  + Clear stale ifcfg files for accelerated NICs (bsc#1199853)
  + More debug messages
  + Documentation update</changelog>
  <changelog author="jgleissner@suse.com" date="1693396800">- Update to version 1.8:
  + Fix Azure metadata check (bsc#1214715)
  + Fix cleanup on ifdown</changelog>
</package>
<package pkgid="c6fa23ae082555d6ea55fe248b1900271edb6339a2f50139b884be6204cd5169" name="cloud-netconfig-ec2" arch="src">
  <version epoch="0" ver="1.8" rel="150000.25.11.1"/>
  <changelog author="rjschwei@suse.com" date="1507723200">- Update to version 0.5
  + New API version for Azure metadata server
  + Wait for the metadata server in EC2</changelog>
  <changelog author="jgleissner@suse.com" date="1507896000">- Update to version 0.6:
  + Use tested and supported metadata API versions</changelog>
  <changelog author="jgleissner@suse.com" date="1507896001">- Prepare for SLE11 submission (bsc#1063292)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1510228800">- Add missing Provides/Conflicts statements to spec file</changelog>
  <changelog author="jgleissner@suse.com" date="1515758400">- Remove dependency on udev-persistent-ifnames (bsc#1075484)</changelog>
  <changelog author="jgleissner@suse.com" date="1516190400">- Added dependency on curl
- Use otherproviders() only on SLES 11 builds</changelog>
  <changelog author="jgleissner@suse.com" date="1527854400">- Update to version 0.7:
  + no persistent interface names in Azure (bsc#1095485)</changelog>
  <changelog author="jgleissner@suse.com" date="1548936000">- Update to version 0.9:
  + run cloud-netconfig periodically (bsc#1118783 bsc#1122013)
  + do not treat eth0 special wrt routing policies (bsc#1123008)
  + reduce timeout on metadata read (bsc#1112822)</changelog>
  <changelog author="jgleissner@suse.com" date="1558008000">- Update to version 1.0:
  + pause and retry if API call throttling is detected in Azure
    (bsc#1135257 bsc#1135263)</changelog>
  <changelog author="jgleissner@suse.com" date="1574337600">- Update to version 1.1
  + fix use of GATEWAY variable (bsc#1157117, bsc#1157190)
  + remove secondary IPv4 address only when added by cloud-netconfig
    (bsc#1144282)
  + simplify routing setup for single NIC systems (partly fixes
    bsc#1135592)</changelog>
  <changelog author="jgleissner@suse.com" date="1574769600">- Update to version 1.2:
  + support AWS IMDSv2 token</changelog>
  <changelog author="jgleissner@suse.com" date="1574769601">- Update to version 1.3:
  + Fix IPv4 address handling on secondary NICs in Azure</changelog>
  <changelog author="jgleissner@suse.com" date="1574942400">- Removed obsolete Group tag from spec file</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="jgleissner@suse.com" date="1580817600">- Update to version 1.4:
  + copy routes from default routing table (bsc#1162705, bsc#1162707)
  + make CLOUD_NETCONFIG_MANAGE default configurable</changelog>
  <changelog author="jgleissner@suse.com" date="1604577600">- Update to version 1.5:
  + Add support for GCE (bsc#1159460, bsc#1178486)
  + Improve default gateway determination</changelog>
  <changelog author="jgleissner@suse.com" date="1630065600">- Update to version 1.6:
  + Ignore proxy when accessing metadata (bsc#1187939)
  + Print warning in case metadata is not accessible
  + Documentation update</changelog>
  <changelog author="suse-beta@cboltz.de" date="1663502400">- /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in
  Tumbleweed, update path (poo#116221)</changelog>
  <changelog author="jgleissner@suse.com" date="1671192000">- Update to version 1.7:
  + Overhaul policy routing setup (issue #19)
  + Support alias IPv4 ranges (issue #14)
  + Add support for NetworkManager (bsc#1204549)
  + Remove dependency on netconfig
  + Install into libexec directory
  + Clear stale ifcfg files for accelerated NICs (bsc#1199853)
  + More debug messages
  + Documentation update</changelog>
  <changelog author="jgleissner@suse.com" date="1693396800">- Update to version 1.8:
  + Fix Azure metadata check (bsc#1214715)
  + Fix cleanup on ifdown</changelog>
</package>
<package pkgid="e96addec1958e48b5aa2ee7f4ec229b5d5bdf1a6081f5f25df1ba12ff2be61e4" name="cloud-netconfig-gce" arch="noarch">
  <version epoch="0" ver="1.8" rel="150000.25.11.1"/>
  <changelog author="rjschwei@suse.com" date="1507723200">- Update to version 0.5
  + New API version for Azure metadata server
  + Wait for the metadata server in EC2</changelog>
  <changelog author="jgleissner@suse.com" date="1507896000">- Update to version 0.6:
  + Use tested and supported metadata API versions</changelog>
  <changelog author="jgleissner@suse.com" date="1507896001">- Prepare for SLE11 submission (bsc#1063292)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1510228800">- Add missing Provides/Conflicts statements to spec file</changelog>
  <changelog author="jgleissner@suse.com" date="1515758400">- Remove dependency on udev-persistent-ifnames (bsc#1075484)</changelog>
  <changelog author="jgleissner@suse.com" date="1516190400">- Added dependency on curl
- Use otherproviders() only on SLES 11 builds</changelog>
  <changelog author="jgleissner@suse.com" date="1527854400">- Update to version 0.7:
  + no persistent interface names in Azure (bsc#1095485)</changelog>
  <changelog author="jgleissner@suse.com" date="1548936000">- Update to version 0.9:
  + run cloud-netconfig periodically (bsc#1118783 bsc#1122013)
  + do not treat eth0 special wrt routing policies (bsc#1123008)
  + reduce timeout on metadata read (bsc#1112822)</changelog>
  <changelog author="jgleissner@suse.com" date="1558008000">- Update to version 1.0:
  + pause and retry if API call throttling is detected in Azure
    (bsc#1135257 bsc#1135263)</changelog>
  <changelog author="jgleissner@suse.com" date="1574337600">- Update to version 1.1
  + fix use of GATEWAY variable (bsc#1157117, bsc#1157190)
  + remove secondary IPv4 address only when added by cloud-netconfig
    (bsc#1144282)
  + simplify routing setup for single NIC systems (partly fixes
    bsc#1135592)</changelog>
  <changelog author="jgleissner@suse.com" date="1574769600">- Update to version 1.2:
  + support AWS IMDSv2 token</changelog>
  <changelog author="jgleissner@suse.com" date="1574769601">- Update to version 1.3:
  + Fix IPv4 address handling on secondary NICs in Azure</changelog>
  <changelog author="jgleissner@suse.com" date="1574942400">- Removed obsolete Group tag from spec file</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="jgleissner@suse.com" date="1580817600">- Update to version 1.4:
  + copy routes from default routing table (bsc#1162705, bsc#1162707)
  + make CLOUD_NETCONFIG_MANAGE default configurable</changelog>
  <changelog author="jgleissner@suse.com" date="1604577600">- Update to version 1.5:
  + Add support for GCE (bsc#1159460, bsc#1178486)
  + Improve default gateway determination</changelog>
  <changelog author="jgleissner@suse.com" date="1630065600">- Update to version 1.6:
  + Ignore proxy when accessing metadata (bsc#1187939)
  + Print warning in case metadata is not accessible
  + Documentation update</changelog>
  <changelog author="suse-beta@cboltz.de" date="1663502400">- /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in
  Tumbleweed, update path (poo#116221)</changelog>
  <changelog author="jgleissner@suse.com" date="1671192000">- Update to version 1.7:
  + Overhaul policy routing setup (issue #19)
  + Support alias IPv4 ranges (issue #14)
  + Add support for NetworkManager (bsc#1204549)
  + Remove dependency on netconfig
  + Install into libexec directory
  + Clear stale ifcfg files for accelerated NICs (bsc#1199853)
  + More debug messages
  + Documentation update</changelog>
  <changelog author="jgleissner@suse.com" date="1693396800">- Update to version 1.8:
  + Fix Azure metadata check (bsc#1214715)
  + Fix cleanup on ifdown</changelog>
</package>
<package pkgid="2a53a5a86a5560e8b608cd7447f0050a7bc8843a6ad70297c77c03ac52ba27f7" name="cloud-netconfig-gce" arch="src">
  <version epoch="0" ver="1.8" rel="150000.25.11.1"/>
  <changelog author="rjschwei@suse.com" date="1507723200">- Update to version 0.5
  + New API version for Azure metadata server
  + Wait for the metadata server in EC2</changelog>
  <changelog author="jgleissner@suse.com" date="1507896000">- Update to version 0.6:
  + Use tested and supported metadata API versions</changelog>
  <changelog author="jgleissner@suse.com" date="1507896001">- Prepare for SLE11 submission (bsc#1063292)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1510228800">- Add missing Provides/Conflicts statements to spec file</changelog>
  <changelog author="jgleissner@suse.com" date="1515758400">- Remove dependency on udev-persistent-ifnames (bsc#1075484)</changelog>
  <changelog author="jgleissner@suse.com" date="1516190400">- Added dependency on curl
- Use otherproviders() only on SLES 11 builds</changelog>
  <changelog author="jgleissner@suse.com" date="1527854400">- Update to version 0.7:
  + no persistent interface names in Azure (bsc#1095485)</changelog>
  <changelog author="jgleissner@suse.com" date="1548936000">- Update to version 0.9:
  + run cloud-netconfig periodically (bsc#1118783 bsc#1122013)
  + do not treat eth0 special wrt routing policies (bsc#1123008)
  + reduce timeout on metadata read (bsc#1112822)</changelog>
  <changelog author="jgleissner@suse.com" date="1558008000">- Update to version 1.0:
  + pause and retry if API call throttling is detected in Azure
    (bsc#1135257 bsc#1135263)</changelog>
  <changelog author="jgleissner@suse.com" date="1574337600">- Update to version 1.1
  + fix use of GATEWAY variable (bsc#1157117, bsc#1157190)
  + remove secondary IPv4 address only when added by cloud-netconfig
    (bsc#1144282)
  + simplify routing setup for single NIC systems (partly fixes
    bsc#1135592)</changelog>
  <changelog author="jgleissner@suse.com" date="1574769600">- Update to version 1.2:
  + support AWS IMDSv2 token</changelog>
  <changelog author="jgleissner@suse.com" date="1574769601">- Update to version 1.3:
  + Fix IPv4 address handling on secondary NICs in Azure</changelog>
  <changelog author="jgleissner@suse.com" date="1574942400">- Removed obsolete Group tag from spec file</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(udev) instead of udev: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="jgleissner@suse.com" date="1580817600">- Update to version 1.4:
  + copy routes from default routing table (bsc#1162705, bsc#1162707)
  + make CLOUD_NETCONFIG_MANAGE default configurable</changelog>
  <changelog author="jgleissner@suse.com" date="1604577600">- Update to version 1.5:
  + Add support for GCE (bsc#1159460, bsc#1178486)
  + Improve default gateway determination</changelog>
  <changelog author="jgleissner@suse.com" date="1630065600">- Update to version 1.6:
  + Ignore proxy when accessing metadata (bsc#1187939)
  + Print warning in case metadata is not accessible
  + Documentation update</changelog>
  <changelog author="suse-beta@cboltz.de" date="1663502400">- /etc/netconfig.d/ moved to /usr/libexec/netconfig/netconfig.d/ in
  Tumbleweed, update path (poo#116221)</changelog>
  <changelog author="jgleissner@suse.com" date="1671192000">- Update to version 1.7:
  + Overhaul policy routing setup (issue #19)
  + Support alias IPv4 ranges (issue #14)
  + Add support for NetworkManager (bsc#1204549)
  + Remove dependency on netconfig
  + Install into libexec directory
  + Clear stale ifcfg files for accelerated NICs (bsc#1199853)
  + More debug messages
  + Documentation update</changelog>
  <changelog author="jgleissner@suse.com" date="1693396800">- Update to version 1.8:
  + Fix Azure metadata check (bsc#1214715)
  + Fix cleanup on ifdown</changelog>
</package>
<package pkgid="d9404703e04a9603fbf3d2f27b866495d0ce5bc2560329cffc55cdff064ea054" name="cloud-regionsrv-client" arch="noarch">
  <version epoch="0" ver="10.1.3" rel="150000.6.99.1"/>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
</package>
<package pkgid="e884d71114ea4535dabb64d892f46635fb58fcf81ba3bea5398c35da3f3c50a8" name="cloud-regionsrv-client" arch="src">
  <version epoch="0" ver="10.1.3" rel="150000.6.99.1"/>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
</package>
<package pkgid="607559670e6e141fe1a622deeb9509c21b60b3ea7f1acce257ce8b6b7fcd324e" name="cloud-regionsrv-client-addon-azure" arch="noarch">
  <version epoch="0" ver="1.0.5" rel="150000.6.99.1"/>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
</package>
<package pkgid="831c3b1dc52c7506ad422bada408c5b10a967a775fee4a96e9e0ca69d4924778" name="cloud-regionsrv-client-generic-config" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="150000.6.99.1"/>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
</package>
<package pkgid="c74a9beaac2b38bf8c629bf24a2b860a189b8f9f51b7b47238d2220817c5845d" name="cloud-regionsrv-client-plugin-azure" arch="noarch">
  <version epoch="0" ver="2.0.0" rel="150000.6.99.1"/>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
</package>
<package pkgid="78fd8ec031ec9b35c2869853fd5162c933b0b0031cb1b31c9a50c43d4cb81bf4" name="cloud-regionsrv-client-plugin-ec2" arch="noarch">
  <version epoch="0" ver="1.0.2" rel="150000.6.99.1"/>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
</package>
<package pkgid="73d6cb352c25b5e3bec2b70d9bd561ae46832977b63394f03d3e4cb10d152ecd" name="cloud-regionsrv-client-plugin-gce" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="150000.6.99.1"/>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
  <changelog author="rjschwei@suse.com" date="1636718400">- Update to version 9.3.0 (jsc#PCT-130)
  + Support AHB-v3
  + Support registration of BYOS instances against the update infrastructure
  + Properly extract the region for local zones in AWS to ensure instances
    get connected to the proper update servers
  + Azure addon service and executable rename
  + Support non SLE repos
  + Fix handling of regionservers configured with DNS names</changelog>
  <changelog author="rjschwei@suse.com" date="1642161600">- Follow up changes to (jsc#PCT-130, bsc#1182026)
  + Fix executable name for AHB service/timer
  + Update manpage for BYOS instance registration</changelog>
  <changelog author="rjschwei@suse.com" date="1643976000">- Update to version 10.0.0 (bsc#1195414, bsc#1195564)
  + Refactor removes check_registration() function in utils implementation
  + Only start the registration service for PAYG images
  - addon-azure sub-package to version 1.0.1</changelog>
  <changelog author="rjschwei@suse.com" date="1645617600">- Update -addon-azure to 1.0.2 (bsc#1196305)
  + The is-registered() function expects a string of the update server FQDN.
    The regionsrv-enabler-azure passed an Object of type SMT. Fix the call
    in regionsrv-enabler-azure.
- Update -plugin-azure to 2.0.0 (bsc#1196146)
  + Lower case the region hint to reduce issues with Azure region name
    case inconsistencies</changelog>
  <changelog author="rjschwei@suse.com" date="1647604800">- Update to version 10.0.1 (bsc#1197113)
  + Provide status feedback on registration, success or failure
  + Log warning message if data provider is configured but no data
    can be retrieved
- Update -addon-azure to 1.0.3 follow up fix for (bsc#1195414, bsc#1195564)
  + The repo enablement timer cannot depend on guestregister.service</changelog>
  <changelog author="rjschwei@suse.com" date="1647604801">- Update to version 10.0.2
  + Fix name of logfile in error message
  + Fix variable scoping to properly detect registration error
  + Cleanup any artifacts on registration failure
  + Fix latent bug with /etc/hosts population
  + Do not throw error when attemting to unregister a system that is not
    registered
  + Skip extension registration if the extension is recommended by the
    baseproduct as it gets automatically installed</changelog>
  <changelog author="rjschwei@suse.com" date="1649937600">- Update to version 10.0.3 (bsc#1198389)
  - Descend into the extension tree even if top level module is recommended
  - Cache license state for AHB support to detect type switch
  - Properly clean suse.com credentials when switching from SCC to update
    infrastructure
  - New log message to indicate base product registration success</changelog>
  <changelog author="rjschwei@suse.com" date="1652961600">- Update to version 10.0.4 (bsc#1199668)
  - Store the update server certs in the /etc path instead of /usr to
    accomodate read only setup of SLE-Micro</changelog>
  <changelog author="rjschwei@suse.com" date="1658318400">- Update to version 10.0.5 (bsc#1201612)
  - Handle exception when trying to deregister a system form the server</changelog>
  <changelog author="rjschwei@suse.com" date="1661428800">- Follow up fix to 10.0.4 (bsc#1202706)
  - While the source code was updated to support SLE Micro the spec file
    was not updated for the new locations of the cache and the certs.
    Update the spec file to be consistent with the code implementation.</changelog>
  <changelog author="james.mason@suse.com" date="1668600000">- Add patch to block IPv6 on SLE12 (bsc#1203382)</changelog>
  <changelog author="rjschwei@suse.com" date="1669118400">- Update to version 10.0.7 (bsc#1191880, bsc#1195925, bsc#1195924)
  - Implement functionality to detect if an update server has a new cert.
    Import the new cert when it is detected.
  - Forward port fix-for-sles12-disable-ipv6.patch
- From 10.0.6 (bsc#1205089)
  - Credentials are equal when username and password are the same ignore
    other entries in the credentials file
  - Handle multiple zypper names in process table, zypper and Zypp-main
    to properly detect the running process</changelog>
  <changelog author="rjschwei@suse.com" date="1670328000">- Guard dmidecode dependency (bsc#1206082)</changelog>
  <changelog author="rjschwei@suse.com" date="1671105600">- Update to version 10.0.8 (bsc#1206428)
  - Fix regression introduced by 10.0.7. When the hosts file was modified
    such that there is no empty line at the end of the file the content
    after removing the registration data does not match the content prior
    to registration. The update fixes the issue triggered by an index
    logic error.</changelog>
  <changelog author="amunoz@suse.com" date="1676289600">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="amunoz@suse.com" date="1676289601">- Update to version 10.1.0 (bsc#1207133, bsc#1208097, bsc#1208099 )
  - Removes a warning about system_token entry present in the credentials
  file.
  - Adds logrotate configuration for log rotation.</changelog>
  <changelog author="rjschwei@suse.com" date="1680782400">- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
  + Clean up the system if baseproduct registraion fails to leave the
    system in prestine state
  + Log when the registercloudguest command is invoked with --clean</changelog>
  <changelog author="rjschwei@suse.com" date="1683806400">- Update to version 10.1.2 (bsc#1211282)
  + Properly handle Ipv6 when checking update server responsiveness. If not
    available fall back and use IPv4 information
  + Use systemd_ordered to allow use in a container without pulling systemd
    into the container as a requirement</changelog>
  <changelog author="rjschwei@suse.com" date="1694779200">- Update to version 10.1.3 (bsc#1214801)
  + Add a warning if we detect a Python package cert bundle for certifi
    This will help with debugging and point to potential issues when
    using SUSE images in AWS, Azure, and GCE</changelog>
</package>
<package pkgid="85892e540deaf996ed8950dba4e7a580a380457c2b7303a3c6ab667ec3bebeaf" name="cni" arch="aarch64">
  <version epoch="0" ver="1.1.2" rel="150500.3.2.1"/>
  <changelog author="alvaro.saurin@suse.com" date="1490184000">- Update to version 0.5.0:
  * Documentation: Add conventions doc
  * noop: allow specifying debug file in config JSON
  * Spec/Conventions: Update to include plugin config
  * spec: add network configuration list specification
  * api,libcni: add network config list-based plugin chaining
  * Update CONVENTIONS.md
  * skel: adds PluginMainWithError which returns a *types.Error
  * testutils: pass netConf in for version operations; pass raw result out for tests
  * types: make Result an interface and move existing Result to separate package
  * macvlan/ipvlan: use common RenameLink method
  * plugins/flannel: organize test JSON alphabetically
  * pkg/ipam: add testcases
  * spec/plugins: return interface details and multiple IP addresses to runtime
  * spec, libcni, pkg/invoke: Use OS-agnostic separator when parsing CNI_PATH
  * pkg/utils/sysctl/sysctl_linux.go: fix build tag.
  * pkg/utils/sysctl/sysctl_linux.go: fix typo.
  * invoke: Enable plugin file names with extensions
  * CONVENTIONS.md: Update details on port-mappings
  * Update with feedback
  * More markups
  * spec: Remove `routes` from Network Configuration
  * docs: consolidate host-local documentation
  * pkg/ns: refactored so that builds succeed on non-linux platforms
  * Fix grammar
  * plugins/main/ptp: set the Sandbox property on the response
  * README: List multus as 3rd party plugin
  * Replace Michael Bridgen with Bryan Boreham
  * pkg/ns, pkg/types: refactored non linux build fix code to
  * pkg/ip: refactored so that builds succeed on non-linux platforms
  * vendor: Update vishvanana/netlink dependency
  * libcni: up-convert a Config to a ConfigList when no other configs are found.
  * docs: CNI versioning for 0.3.0 upgrade
  * docs: Edits to v0.3.0 upgrade guidance
  * docs: minor improvements to 0.3.0 upgrade guidance
  * docs: add small upgrade instructions
  * docs: minor improvements to spec-upgrades
  * docs: fill-out and correct version conversion table
  * docs: table formatting is hard
  * pkg/testutils: return errors after restoring stdout
  * pkg/types: misc current types testcase cleanups
  * Minor rewording about default config version
  * spec,libcni: add support for injecting runtimeConfig into plugin stdin data
  * Check n.IPAM before use it in LoadIPAMConfig function
  * do not error if last_reserved_ip is missing for host local ipam
  * add test for ensuring initial subnet creation does not contain an error
  * fix unrelated failing tests</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1490270400">- Update to version 0.5.1:
  * readme.md: Add link to community sync
  * pkg/ip: do not leak types from vendored netlink package
  * pkg/ip: SetupVeth returns net.Interface
  * pkg/ip: improve docstring for SetupVeth
  * Added Romana to list of CNI providers...
  * plugins/meta/flannel: If net config is missing do not return err on DEL
  * plugins/*: Don't error if the device doesn't exist</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1491825600">- Update to version 0.5.2:
  * Rename build script to avoid conflict with bazel
  * Enable s390x build
  * Update community sync detail
  * Added entry for CNI-Genie
  * travis: shift forward to Go 1.8 and 1.7
  * spec/plugins: fix 'ip'-&gt;'ips' in the spec, bump to 0.3.1
  * libcni: Improved error messages.
  * libcni: Fixed tests that were checking error strings.
  * Documentation: Added documentation for `cnitool`.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1503921600">- Update to version 0.6.0:
  * Conventions: add convention around chaining interfaces
  * pkg/types: safer typecasting for TextUnmarshaler when loading args
  * pkg/types: modify LoadArgs to return a named error when an unmarshalable condition is detected
  * Update note about next Community Sync, 2017-06-21
  * types: fix marshalling of omitted "interfaces" key in IPConfig JSON
  * Update and document release process
  * scripts/release.sh: Add in s390x architecture
  * cnitool: add support for CNI_ARGS
  * README plugins list: add Linen CNI plugin</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1513684800">- Remove the dependency with the cni-plugins
- Recommend the cni-plugins</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1516017600">- Make /var/lib/cni writable</changelog>
  <changelog author="kmacinnes@suse.com" date="1516276800">- Add snapper as a requirement, to provide mksubvolume</changelog>
  <changelog author="kmacinnes@suse.com" date="1517227200">- Use full/absolute path for mksubvolume
- Change snapper Requires to a Requires(post)</changelog>
  <changelog author="jmassaguerpla@suse.com" date="1522843200">- Remove creating subvolumes. This should be in another package (kubernetes-kubelet)</changelog>
  <changelog author="dcassany@suse.com" date="1528113600">- Make use of %license macro</changelog>
  <changelog author="dcassany@suse.com" date="1528200000">- Refactor %license usage to a simpler form</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558094400">- Update to version 0.7.0:
  * Spec changes:
    + Use more RFC2119 style language in specification (must, should...)
    + add notes about ADD/DEL ordering
    + Make the container ID required and unique.
    + remove the version parameter from ADD and DEL commands.
    + Network interface name matters
    + be explicit about optional and required structure members
    + add CHECK method
    + Add a well-known error for "try again"
    + SPEC.md: clarify meaning of 'routes'
  * Library changes:
    + pkg/types: Makes IPAM concrete type
    + libcni: return error if Type is empty
    + skel: VERSION shouldn't block on stdin
    + non-pointer instances of types.Route now correctly marshal to JSON
    + libcni: add ValidateNetwork and ValidateNetworkList functions
    + pkg/skel: return error if JSON config has no network name
    + skel: add support for plugin version string
    + libcni: make exec handling an interface for better downstream testing
    + libcni: api now takes a Context to allow operations to be timed out or cancelled
    + types/version: add helper to parse PrevResult
    + skel: only print about message, not errors
    + skel,invoke,libcni: implementation of CHECK method
    + cnitool: Honor interface name supplied via CNI_IFNAME environment variable.
    + cnitool: validate correct number of args
    + Don't copy gw from IP4.Gateway to Route.GW When converting from 0.2.0
    + add PrintTo method to Result interface
    + Return a better error when the plugin returns none
- Install sleep binary into CNI plugin directory
- Restore build.sh script which was removed upstream</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1563278400">- Update to version 0.7.1 (bsc#1160460):
  * Library changes:
    + invoke : ensure custom envs of CNIArgs are prepended to process envs
    + add GetNetworkListCachedResult to CNI interface
    + delegate : allow delegation funcs override CNI_COMMAND env automatically in heritance
  * Documentation &amp; Convention changes:
    + Update cnitool documentation for spec v0.4.0
    + Add cni-route-override to CNI plugin list
  * Build and test changes:
    + Release: bump go to v1.12</changelog>
  <changelog author="sgrunert@suse.com" date="1578916800">- Set correct CNI version for 99-loopback.conf</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601553600">- Update to version 0.8.0:
  * Specification and Conventions changes
    + docs: add ips and mac to well-known capabilities
    + add interface name validation
    + Add GUID to well known Capabilities
    + Add DeviceID attribute to RuntimeConfig
    + Typo fixes for infiniband GUID
    + Fix linting issues in docs, add headers to json example, update errors into table
  * Documentation changes
    + Update cnitool docs
    + Remove extra ',' chars which makes conflist examples invalid.
  * libcni changes
    + Remove Result.String method
    + libcni: add config caching [v2]
    + clean up : fix staticcheck warnings
    + libcni: add InitCNIConfigWithCacheDir() and deprecate RuntimeConfig.CacheDir
    + skel: clean up errors in skel and add some well-known error codes
    + libcni: find plugin in exec
    + validate containerID and networkName
    + skel: remove needless functions and types
    + libcni: also cache IfName
    + libcni: fix cache file 'result' key name
    + Bump Go version to 1.13
    + When CNI version isn't supplied in config, use default.
    + intercept netplugin std error
    + invoke: capture and return stderr if plugin exits unexpectedly
    + Retry exec commands on text file busy</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615896000">- Set GO111MODULE=auto to build with go1.16+
  * Default changed to GO111MODULE=on in go1.16
  * Set temporarily until using upstream release with go.mod
  * Drop BuildRequires: golang-packaging not currently using macros
  * Add BuildRequires: golang(API) &gt;= 1.13 recommended dependency expression</changelog>
  <changelog author="dmueller@suse.com" date="1619265600">- use buildmode=pie (cnitool is installed into sbindir)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1622462400">- Update to version 0.8.1:
  * This is a security release that fixes a single bug: bsc#1181961 aka CVE-2021-20206
  - Tighten up plugin-finding logic (#811).</changelog>
  <changelog author="idesmi@protonmail.com" date="1648296000">- Update to version v1.0.1:
  * Rewritten spec
    + non-List configurations are removed
    + the version field in the interfaces array was redundant and
    is removed
  * libcni improvements
- Employ RPM macros.go where feasible
- Use vendor tarball
- Remove ./build.sh</changelog>
  <changelog author="andrea.manzini@suse.com" date="1668081600">- Update to version 1.1.2:
  * spec: fix format
  * libcni: handle empty version when parsing version
  * [exec-plugins]: support plugin lists
  This is a minor update to the CNI libraries and tooling.
  This does not bump the protocol / spec version, which remains at v1.0.0</changelog>
</package>
<package pkgid="9c6734be7752bba340bbd795c37b3df3678867dff259c8f1694d69a0a0821e6c" name="cni" arch="s390x">
  <version epoch="0" ver="1.1.2" rel="150500.3.2.1"/>
  <changelog author="alvaro.saurin@suse.com" date="1490184000">- Update to version 0.5.0:
  * Documentation: Add conventions doc
  * noop: allow specifying debug file in config JSON
  * Spec/Conventions: Update to include plugin config
  * spec: add network configuration list specification
  * api,libcni: add network config list-based plugin chaining
  * Update CONVENTIONS.md
  * skel: adds PluginMainWithError which returns a *types.Error
  * testutils: pass netConf in for version operations; pass raw result out for tests
  * types: make Result an interface and move existing Result to separate package
  * macvlan/ipvlan: use common RenameLink method
  * plugins/flannel: organize test JSON alphabetically
  * pkg/ipam: add testcases
  * spec/plugins: return interface details and multiple IP addresses to runtime
  * spec, libcni, pkg/invoke: Use OS-agnostic separator when parsing CNI_PATH
  * pkg/utils/sysctl/sysctl_linux.go: fix build tag.
  * pkg/utils/sysctl/sysctl_linux.go: fix typo.
  * invoke: Enable plugin file names with extensions
  * CONVENTIONS.md: Update details on port-mappings
  * Update with feedback
  * More markups
  * spec: Remove `routes` from Network Configuration
  * docs: consolidate host-local documentation
  * pkg/ns: refactored so that builds succeed on non-linux platforms
  * Fix grammar
  * plugins/main/ptp: set the Sandbox property on the response
  * README: List multus as 3rd party plugin
  * Replace Michael Bridgen with Bryan Boreham
  * pkg/ns, pkg/types: refactored non linux build fix code to
  * pkg/ip: refactored so that builds succeed on non-linux platforms
  * vendor: Update vishvanana/netlink dependency
  * libcni: up-convert a Config to a ConfigList when no other configs are found.
  * docs: CNI versioning for 0.3.0 upgrade
  * docs: Edits to v0.3.0 upgrade guidance
  * docs: minor improvements to 0.3.0 upgrade guidance
  * docs: add small upgrade instructions
  * docs: minor improvements to spec-upgrades
  * docs: fill-out and correct version conversion table
  * docs: table formatting is hard
  * pkg/testutils: return errors after restoring stdout
  * pkg/types: misc current types testcase cleanups
  * Minor rewording about default config version
  * spec,libcni: add support for injecting runtimeConfig into plugin stdin data
  * Check n.IPAM before use it in LoadIPAMConfig function
  * do not error if last_reserved_ip is missing for host local ipam
  * add test for ensuring initial subnet creation does not contain an error
  * fix unrelated failing tests</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1490270400">- Update to version 0.5.1:
  * readme.md: Add link to community sync
  * pkg/ip: do not leak types from vendored netlink package
  * pkg/ip: SetupVeth returns net.Interface
  * pkg/ip: improve docstring for SetupVeth
  * Added Romana to list of CNI providers...
  * plugins/meta/flannel: If net config is missing do not return err on DEL
  * plugins/*: Don't error if the device doesn't exist</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1491825600">- Update to version 0.5.2:
  * Rename build script to avoid conflict with bazel
  * Enable s390x build
  * Update community sync detail
  * Added entry for CNI-Genie
  * travis: shift forward to Go 1.8 and 1.7
  * spec/plugins: fix 'ip'-&gt;'ips' in the spec, bump to 0.3.1
  * libcni: Improved error messages.
  * libcni: Fixed tests that were checking error strings.
  * Documentation: Added documentation for `cnitool`.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1503921600">- Update to version 0.6.0:
  * Conventions: add convention around chaining interfaces
  * pkg/types: safer typecasting for TextUnmarshaler when loading args
  * pkg/types: modify LoadArgs to return a named error when an unmarshalable condition is detected
  * Update note about next Community Sync, 2017-06-21
  * types: fix marshalling of omitted "interfaces" key in IPConfig JSON
  * Update and document release process
  * scripts/release.sh: Add in s390x architecture
  * cnitool: add support for CNI_ARGS
  * README plugins list: add Linen CNI plugin</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1513684800">- Remove the dependency with the cni-plugins
- Recommend the cni-plugins</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1516017600">- Make /var/lib/cni writable</changelog>
  <changelog author="kmacinnes@suse.com" date="1516276800">- Add snapper as a requirement, to provide mksubvolume</changelog>
  <changelog author="kmacinnes@suse.com" date="1517227200">- Use full/absolute path for mksubvolume
- Change snapper Requires to a Requires(post)</changelog>
  <changelog author="jmassaguerpla@suse.com" date="1522843200">- Remove creating subvolumes. This should be in another package (kubernetes-kubelet)</changelog>
  <changelog author="dcassany@suse.com" date="1528113600">- Make use of %license macro</changelog>
  <changelog author="dcassany@suse.com" date="1528200000">- Refactor %license usage to a simpler form</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558094400">- Update to version 0.7.0:
  * Spec changes:
    + Use more RFC2119 style language in specification (must, should...)
    + add notes about ADD/DEL ordering
    + Make the container ID required and unique.
    + remove the version parameter from ADD and DEL commands.
    + Network interface name matters
    + be explicit about optional and required structure members
    + add CHECK method
    + Add a well-known error for "try again"
    + SPEC.md: clarify meaning of 'routes'
  * Library changes:
    + pkg/types: Makes IPAM concrete type
    + libcni: return error if Type is empty
    + skel: VERSION shouldn't block on stdin
    + non-pointer instances of types.Route now correctly marshal to JSON
    + libcni: add ValidateNetwork and ValidateNetworkList functions
    + pkg/skel: return error if JSON config has no network name
    + skel: add support for plugin version string
    + libcni: make exec handling an interface for better downstream testing
    + libcni: api now takes a Context to allow operations to be timed out or cancelled
    + types/version: add helper to parse PrevResult
    + skel: only print about message, not errors
    + skel,invoke,libcni: implementation of CHECK method
    + cnitool: Honor interface name supplied via CNI_IFNAME environment variable.
    + cnitool: validate correct number of args
    + Don't copy gw from IP4.Gateway to Route.GW When converting from 0.2.0
    + add PrintTo method to Result interface
    + Return a better error when the plugin returns none
- Install sleep binary into CNI plugin directory
- Restore build.sh script which was removed upstream</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1563278400">- Update to version 0.7.1 (bsc#1160460):
  * Library changes:
    + invoke : ensure custom envs of CNIArgs are prepended to process envs
    + add GetNetworkListCachedResult to CNI interface
    + delegate : allow delegation funcs override CNI_COMMAND env automatically in heritance
  * Documentation &amp; Convention changes:
    + Update cnitool documentation for spec v0.4.0
    + Add cni-route-override to CNI plugin list
  * Build and test changes:
    + Release: bump go to v1.12</changelog>
  <changelog author="sgrunert@suse.com" date="1578916800">- Set correct CNI version for 99-loopback.conf</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601553600">- Update to version 0.8.0:
  * Specification and Conventions changes
    + docs: add ips and mac to well-known capabilities
    + add interface name validation
    + Add GUID to well known Capabilities
    + Add DeviceID attribute to RuntimeConfig
    + Typo fixes for infiniband GUID
    + Fix linting issues in docs, add headers to json example, update errors into table
  * Documentation changes
    + Update cnitool docs
    + Remove extra ',' chars which makes conflist examples invalid.
  * libcni changes
    + Remove Result.String method
    + libcni: add config caching [v2]
    + clean up : fix staticcheck warnings
    + libcni: add InitCNIConfigWithCacheDir() and deprecate RuntimeConfig.CacheDir
    + skel: clean up errors in skel and add some well-known error codes
    + libcni: find plugin in exec
    + validate containerID and networkName
    + skel: remove needless functions and types
    + libcni: also cache IfName
    + libcni: fix cache file 'result' key name
    + Bump Go version to 1.13
    + When CNI version isn't supplied in config, use default.
    + intercept netplugin std error
    + invoke: capture and return stderr if plugin exits unexpectedly
    + Retry exec commands on text file busy</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615896000">- Set GO111MODULE=auto to build with go1.16+
  * Default changed to GO111MODULE=on in go1.16
  * Set temporarily until using upstream release with go.mod
  * Drop BuildRequires: golang-packaging not currently using macros
  * Add BuildRequires: golang(API) &gt;= 1.13 recommended dependency expression</changelog>
  <changelog author="dmueller@suse.com" date="1619265600">- use buildmode=pie (cnitool is installed into sbindir)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1622462400">- Update to version 0.8.1:
  * This is a security release that fixes a single bug: bsc#1181961 aka CVE-2021-20206
  - Tighten up plugin-finding logic (#811).</changelog>
  <changelog author="idesmi@protonmail.com" date="1648296000">- Update to version v1.0.1:
  * Rewritten spec
    + non-List configurations are removed
    + the version field in the interfaces array was redundant and
    is removed
  * libcni improvements
- Employ RPM macros.go where feasible
- Use vendor tarball
- Remove ./build.sh</changelog>
  <changelog author="andrea.manzini@suse.com" date="1668081600">- Update to version 1.1.2:
  * spec: fix format
  * libcni: handle empty version when parsing version
  * [exec-plugins]: support plugin lists
  This is a minor update to the CNI libraries and tooling.
  This does not bump the protocol / spec version, which remains at v1.0.0</changelog>
</package>
<package pkgid="bb49162d4e68e9a7bd646d3cb9b48a409a85c84bc0e88c5b1b1e3088180e1e6b" name="cni" arch="src">
  <version epoch="0" ver="1.1.2" rel="150500.3.2.1"/>
  <changelog author="alvaro.saurin@suse.com" date="1490184000">- Update to version 0.5.0:
  * Documentation: Add conventions doc
  * noop: allow specifying debug file in config JSON
  * Spec/Conventions: Update to include plugin config
  * spec: add network configuration list specification
  * api,libcni: add network config list-based plugin chaining
  * Update CONVENTIONS.md
  * skel: adds PluginMainWithError which returns a *types.Error
  * testutils: pass netConf in for version operations; pass raw result out for tests
  * types: make Result an interface and move existing Result to separate package
  * macvlan/ipvlan: use common RenameLink method
  * plugins/flannel: organize test JSON alphabetically
  * pkg/ipam: add testcases
  * spec/plugins: return interface details and multiple IP addresses to runtime
  * spec, libcni, pkg/invoke: Use OS-agnostic separator when parsing CNI_PATH
  * pkg/utils/sysctl/sysctl_linux.go: fix build tag.
  * pkg/utils/sysctl/sysctl_linux.go: fix typo.
  * invoke: Enable plugin file names with extensions
  * CONVENTIONS.md: Update details on port-mappings
  * Update with feedback
  * More markups
  * spec: Remove `routes` from Network Configuration
  * docs: consolidate host-local documentation
  * pkg/ns: refactored so that builds succeed on non-linux platforms
  * Fix grammar
  * plugins/main/ptp: set the Sandbox property on the response
  * README: List multus as 3rd party plugin
  * Replace Michael Bridgen with Bryan Boreham
  * pkg/ns, pkg/types: refactored non linux build fix code to
  * pkg/ip: refactored so that builds succeed on non-linux platforms
  * vendor: Update vishvanana/netlink dependency
  * libcni: up-convert a Config to a ConfigList when no other configs are found.
  * docs: CNI versioning for 0.3.0 upgrade
  * docs: Edits to v0.3.0 upgrade guidance
  * docs: minor improvements to 0.3.0 upgrade guidance
  * docs: add small upgrade instructions
  * docs: minor improvements to spec-upgrades
  * docs: fill-out and correct version conversion table
  * docs: table formatting is hard
  * pkg/testutils: return errors after restoring stdout
  * pkg/types: misc current types testcase cleanups
  * Minor rewording about default config version
  * spec,libcni: add support for injecting runtimeConfig into plugin stdin data
  * Check n.IPAM before use it in LoadIPAMConfig function
  * do not error if last_reserved_ip is missing for host local ipam
  * add test for ensuring initial subnet creation does not contain an error
  * fix unrelated failing tests</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1490270400">- Update to version 0.5.1:
  * readme.md: Add link to community sync
  * pkg/ip: do not leak types from vendored netlink package
  * pkg/ip: SetupVeth returns net.Interface
  * pkg/ip: improve docstring for SetupVeth
  * Added Romana to list of CNI providers...
  * plugins/meta/flannel: If net config is missing do not return err on DEL
  * plugins/*: Don't error if the device doesn't exist</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1491825600">- Update to version 0.5.2:
  * Rename build script to avoid conflict with bazel
  * Enable s390x build
  * Update community sync detail
  * Added entry for CNI-Genie
  * travis: shift forward to Go 1.8 and 1.7
  * spec/plugins: fix 'ip'-&gt;'ips' in the spec, bump to 0.3.1
  * libcni: Improved error messages.
  * libcni: Fixed tests that were checking error strings.
  * Documentation: Added documentation for `cnitool`.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1503921600">- Update to version 0.6.0:
  * Conventions: add convention around chaining interfaces
  * pkg/types: safer typecasting for TextUnmarshaler when loading args
  * pkg/types: modify LoadArgs to return a named error when an unmarshalable condition is detected
  * Update note about next Community Sync, 2017-06-21
  * types: fix marshalling of omitted "interfaces" key in IPConfig JSON
  * Update and document release process
  * scripts/release.sh: Add in s390x architecture
  * cnitool: add support for CNI_ARGS
  * README plugins list: add Linen CNI plugin</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1513684800">- Remove the dependency with the cni-plugins
- Recommend the cni-plugins</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1516017600">- Make /var/lib/cni writable</changelog>
  <changelog author="kmacinnes@suse.com" date="1516276800">- Add snapper as a requirement, to provide mksubvolume</changelog>
  <changelog author="kmacinnes@suse.com" date="1517227200">- Use full/absolute path for mksubvolume
- Change snapper Requires to a Requires(post)</changelog>
  <changelog author="jmassaguerpla@suse.com" date="1522843200">- Remove creating subvolumes. This should be in another package (kubernetes-kubelet)</changelog>
  <changelog author="dcassany@suse.com" date="1528113600">- Make use of %license macro</changelog>
  <changelog author="dcassany@suse.com" date="1528200000">- Refactor %license usage to a simpler form</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558094400">- Update to version 0.7.0:
  * Spec changes:
    + Use more RFC2119 style language in specification (must, should...)
    + add notes about ADD/DEL ordering
    + Make the container ID required and unique.
    + remove the version parameter from ADD and DEL commands.
    + Network interface name matters
    + be explicit about optional and required structure members
    + add CHECK method
    + Add a well-known error for "try again"
    + SPEC.md: clarify meaning of 'routes'
  * Library changes:
    + pkg/types: Makes IPAM concrete type
    + libcni: return error if Type is empty
    + skel: VERSION shouldn't block on stdin
    + non-pointer instances of types.Route now correctly marshal to JSON
    + libcni: add ValidateNetwork and ValidateNetworkList functions
    + pkg/skel: return error if JSON config has no network name
    + skel: add support for plugin version string
    + libcni: make exec handling an interface for better downstream testing
    + libcni: api now takes a Context to allow operations to be timed out or cancelled
    + types/version: add helper to parse PrevResult
    + skel: only print about message, not errors
    + skel,invoke,libcni: implementation of CHECK method
    + cnitool: Honor interface name supplied via CNI_IFNAME environment variable.
    + cnitool: validate correct number of args
    + Don't copy gw from IP4.Gateway to Route.GW When converting from 0.2.0
    + add PrintTo method to Result interface
    + Return a better error when the plugin returns none
- Install sleep binary into CNI plugin directory
- Restore build.sh script which was removed upstream</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1563278400">- Update to version 0.7.1 (bsc#1160460):
  * Library changes:
    + invoke : ensure custom envs of CNIArgs are prepended to process envs
    + add GetNetworkListCachedResult to CNI interface
    + delegate : allow delegation funcs override CNI_COMMAND env automatically in heritance
  * Documentation &amp; Convention changes:
    + Update cnitool documentation for spec v0.4.0
    + Add cni-route-override to CNI plugin list
  * Build and test changes:
    + Release: bump go to v1.12</changelog>
  <changelog author="sgrunert@suse.com" date="1578916800">- Set correct CNI version for 99-loopback.conf</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601553600">- Update to version 0.8.0:
  * Specification and Conventions changes
    + docs: add ips and mac to well-known capabilities
    + add interface name validation
    + Add GUID to well known Capabilities
    + Add DeviceID attribute to RuntimeConfig
    + Typo fixes for infiniband GUID
    + Fix linting issues in docs, add headers to json example, update errors into table
  * Documentation changes
    + Update cnitool docs
    + Remove extra ',' chars which makes conflist examples invalid.
  * libcni changes
    + Remove Result.String method
    + libcni: add config caching [v2]
    + clean up : fix staticcheck warnings
    + libcni: add InitCNIConfigWithCacheDir() and deprecate RuntimeConfig.CacheDir
    + skel: clean up errors in skel and add some well-known error codes
    + libcni: find plugin in exec
    + validate containerID and networkName
    + skel: remove needless functions and types
    + libcni: also cache IfName
    + libcni: fix cache file 'result' key name
    + Bump Go version to 1.13
    + When CNI version isn't supplied in config, use default.
    + intercept netplugin std error
    + invoke: capture and return stderr if plugin exits unexpectedly
    + Retry exec commands on text file busy</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615896000">- Set GO111MODULE=auto to build with go1.16+
  * Default changed to GO111MODULE=on in go1.16
  * Set temporarily until using upstream release with go.mod
  * Drop BuildRequires: golang-packaging not currently using macros
  * Add BuildRequires: golang(API) &gt;= 1.13 recommended dependency expression</changelog>
  <changelog author="dmueller@suse.com" date="1619265600">- use buildmode=pie (cnitool is installed into sbindir)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1622462400">- Update to version 0.8.1:
  * This is a security release that fixes a single bug: bsc#1181961 aka CVE-2021-20206
  - Tighten up plugin-finding logic (#811).</changelog>
  <changelog author="idesmi@protonmail.com" date="1648296000">- Update to version v1.0.1:
  * Rewritten spec
    + non-List configurations are removed
    + the version field in the interfaces array was redundant and
    is removed
  * libcni improvements
- Employ RPM macros.go where feasible
- Use vendor tarball
- Remove ./build.sh</changelog>
  <changelog author="andrea.manzini@suse.com" date="1668081600">- Update to version 1.1.2:
  * spec: fix format
  * libcni: handle empty version when parsing version
  * [exec-plugins]: support plugin lists
  This is a minor update to the CNI libraries and tooling.
  This does not bump the protocol / spec version, which remains at v1.0.0</changelog>
</package>
<package pkgid="d241b02b30ffdc2b023f6f1abdd34fe4380dad299c2c5733624f2bed61748665" name="cni" arch="x86_64">
  <version epoch="0" ver="1.1.2" rel="150500.3.2.1"/>
  <changelog author="alvaro.saurin@suse.com" date="1490184000">- Update to version 0.5.0:
  * Documentation: Add conventions doc
  * noop: allow specifying debug file in config JSON
  * Spec/Conventions: Update to include plugin config
  * spec: add network configuration list specification
  * api,libcni: add network config list-based plugin chaining
  * Update CONVENTIONS.md
  * skel: adds PluginMainWithError which returns a *types.Error
  * testutils: pass netConf in for version operations; pass raw result out for tests
  * types: make Result an interface and move existing Result to separate package
  * macvlan/ipvlan: use common RenameLink method
  * plugins/flannel: organize test JSON alphabetically
  * pkg/ipam: add testcases
  * spec/plugins: return interface details and multiple IP addresses to runtime
  * spec, libcni, pkg/invoke: Use OS-agnostic separator when parsing CNI_PATH
  * pkg/utils/sysctl/sysctl_linux.go: fix build tag.
  * pkg/utils/sysctl/sysctl_linux.go: fix typo.
  * invoke: Enable plugin file names with extensions
  * CONVENTIONS.md: Update details on port-mappings
  * Update with feedback
  * More markups
  * spec: Remove `routes` from Network Configuration
  * docs: consolidate host-local documentation
  * pkg/ns: refactored so that builds succeed on non-linux platforms
  * Fix grammar
  * plugins/main/ptp: set the Sandbox property on the response
  * README: List multus as 3rd party plugin
  * Replace Michael Bridgen with Bryan Boreham
  * pkg/ns, pkg/types: refactored non linux build fix code to
  * pkg/ip: refactored so that builds succeed on non-linux platforms
  * vendor: Update vishvanana/netlink dependency
  * libcni: up-convert a Config to a ConfigList when no other configs are found.
  * docs: CNI versioning for 0.3.0 upgrade
  * docs: Edits to v0.3.0 upgrade guidance
  * docs: minor improvements to 0.3.0 upgrade guidance
  * docs: add small upgrade instructions
  * docs: minor improvements to spec-upgrades
  * docs: fill-out and correct version conversion table
  * docs: table formatting is hard
  * pkg/testutils: return errors after restoring stdout
  * pkg/types: misc current types testcase cleanups
  * Minor rewording about default config version
  * spec,libcni: add support for injecting runtimeConfig into plugin stdin data
  * Check n.IPAM before use it in LoadIPAMConfig function
  * do not error if last_reserved_ip is missing for host local ipam
  * add test for ensuring initial subnet creation does not contain an error
  * fix unrelated failing tests</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1490270400">- Update to version 0.5.1:
  * readme.md: Add link to community sync
  * pkg/ip: do not leak types from vendored netlink package
  * pkg/ip: SetupVeth returns net.Interface
  * pkg/ip: improve docstring for SetupVeth
  * Added Romana to list of CNI providers...
  * plugins/meta/flannel: If net config is missing do not return err on DEL
  * plugins/*: Don't error if the device doesn't exist</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1491825600">- Update to version 0.5.2:
  * Rename build script to avoid conflict with bazel
  * Enable s390x build
  * Update community sync detail
  * Added entry for CNI-Genie
  * travis: shift forward to Go 1.8 and 1.7
  * spec/plugins: fix 'ip'-&gt;'ips' in the spec, bump to 0.3.1
  * libcni: Improved error messages.
  * libcni: Fixed tests that were checking error strings.
  * Documentation: Added documentation for `cnitool`.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1503921600">- Update to version 0.6.0:
  * Conventions: add convention around chaining interfaces
  * pkg/types: safer typecasting for TextUnmarshaler when loading args
  * pkg/types: modify LoadArgs to return a named error when an unmarshalable condition is detected
  * Update note about next Community Sync, 2017-06-21
  * types: fix marshalling of omitted "interfaces" key in IPConfig JSON
  * Update and document release process
  * scripts/release.sh: Add in s390x architecture
  * cnitool: add support for CNI_ARGS
  * README plugins list: add Linen CNI plugin</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1513684800">- Remove the dependency with the cni-plugins
- Recommend the cni-plugins</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1516017600">- Make /var/lib/cni writable</changelog>
  <changelog author="kmacinnes@suse.com" date="1516276800">- Add snapper as a requirement, to provide mksubvolume</changelog>
  <changelog author="kmacinnes@suse.com" date="1517227200">- Use full/absolute path for mksubvolume
- Change snapper Requires to a Requires(post)</changelog>
  <changelog author="jmassaguerpla@suse.com" date="1522843200">- Remove creating subvolumes. This should be in another package (kubernetes-kubelet)</changelog>
  <changelog author="dcassany@suse.com" date="1528113600">- Make use of %license macro</changelog>
  <changelog author="dcassany@suse.com" date="1528200000">- Refactor %license usage to a simpler form</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558094400">- Update to version 0.7.0:
  * Spec changes:
    + Use more RFC2119 style language in specification (must, should...)
    + add notes about ADD/DEL ordering
    + Make the container ID required and unique.
    + remove the version parameter from ADD and DEL commands.
    + Network interface name matters
    + be explicit about optional and required structure members
    + add CHECK method
    + Add a well-known error for "try again"
    + SPEC.md: clarify meaning of 'routes'
  * Library changes:
    + pkg/types: Makes IPAM concrete type
    + libcni: return error if Type is empty
    + skel: VERSION shouldn't block on stdin
    + non-pointer instances of types.Route now correctly marshal to JSON
    + libcni: add ValidateNetwork and ValidateNetworkList functions
    + pkg/skel: return error if JSON config has no network name
    + skel: add support for plugin version string
    + libcni: make exec handling an interface for better downstream testing
    + libcni: api now takes a Context to allow operations to be timed out or cancelled
    + types/version: add helper to parse PrevResult
    + skel: only print about message, not errors
    + skel,invoke,libcni: implementation of CHECK method
    + cnitool: Honor interface name supplied via CNI_IFNAME environment variable.
    + cnitool: validate correct number of args
    + Don't copy gw from IP4.Gateway to Route.GW When converting from 0.2.0
    + add PrintTo method to Result interface
    + Return a better error when the plugin returns none
- Install sleep binary into CNI plugin directory
- Restore build.sh script which was removed upstream</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1563278400">- Update to version 0.7.1 (bsc#1160460):
  * Library changes:
    + invoke : ensure custom envs of CNIArgs are prepended to process envs
    + add GetNetworkListCachedResult to CNI interface
    + delegate : allow delegation funcs override CNI_COMMAND env automatically in heritance
  * Documentation &amp; Convention changes:
    + Update cnitool documentation for spec v0.4.0
    + Add cni-route-override to CNI plugin list
  * Build and test changes:
    + Release: bump go to v1.12</changelog>
  <changelog author="sgrunert@suse.com" date="1578916800">- Set correct CNI version for 99-loopback.conf</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601553600">- Update to version 0.8.0:
  * Specification and Conventions changes
    + docs: add ips and mac to well-known capabilities
    + add interface name validation
    + Add GUID to well known Capabilities
    + Add DeviceID attribute to RuntimeConfig
    + Typo fixes for infiniband GUID
    + Fix linting issues in docs, add headers to json example, update errors into table
  * Documentation changes
    + Update cnitool docs
    + Remove extra ',' chars which makes conflist examples invalid.
  * libcni changes
    + Remove Result.String method
    + libcni: add config caching [v2]
    + clean up : fix staticcheck warnings
    + libcni: add InitCNIConfigWithCacheDir() and deprecate RuntimeConfig.CacheDir
    + skel: clean up errors in skel and add some well-known error codes
    + libcni: find plugin in exec
    + validate containerID and networkName
    + skel: remove needless functions and types
    + libcni: also cache IfName
    + libcni: fix cache file 'result' key name
    + Bump Go version to 1.13
    + When CNI version isn't supplied in config, use default.
    + intercept netplugin std error
    + invoke: capture and return stderr if plugin exits unexpectedly
    + Retry exec commands on text file busy</changelog>
  <changelog author="jkowalczyk@suse.com" date="1615896000">- Set GO111MODULE=auto to build with go1.16+
  * Default changed to GO111MODULE=on in go1.16
  * Set temporarily until using upstream release with go.mod
  * Drop BuildRequires: golang-packaging not currently using macros
  * Add BuildRequires: golang(API) &gt;= 1.13 recommended dependency expression</changelog>
  <changelog author="dmueller@suse.com" date="1619265600">- use buildmode=pie (cnitool is installed into sbindir)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1622462400">- Update to version 0.8.1:
  * This is a security release that fixes a single bug: bsc#1181961 aka CVE-2021-20206
  - Tighten up plugin-finding logic (#811).</changelog>
  <changelog author="idesmi@protonmail.com" date="1648296000">- Update to version v1.0.1:
  * Rewritten spec
    + non-List configurations are removed
    + the version field in the interfaces array was redundant and
    is removed
  * libcni improvements
- Employ RPM macros.go where feasible
- Use vendor tarball
- Remove ./build.sh</changelog>
  <changelog author="andrea.manzini@suse.com" date="1668081600">- Update to version 1.1.2:
  * spec: fix format
  * libcni: handle empty version when parsing version
  * [exec-plugins]: support plugin lists
  This is a minor update to the CNI libraries and tooling.
  This does not bump the protocol / spec version, which remains at v1.0.0</changelog>
</package>
<package pkgid="9afc8a9b37afbd92cd95a2a58a3e336613afea6faa078906d58a56d34d1260df" name="cni-plugins" arch="aarch64">
  <version epoch="0" ver="1.1.1" rel="150500.3.2.1"/>
  <changelog author="alvaro.saurin@suse.com" date="1503921600">- Initial version from CNI plugins v0.6.0</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1503921601">- Install docs in the cni-plugins dir</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1513684800">- Require cni</changelog>
  <changelog author="dcassany@suse.com" date="1528113600">- Make use of %license macro</changelog>
  <changelog author="dcassany@suse.com" date="1528200000">- Refactor %license usage to a simpler form</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1544616000">- Updated to a supported version of Go (due to security reasons)</changelog>
  <changelog author="sgrunert@suse.com" date="1548417600">- Updated plugins to v0.7.4:
  - Add host-device plugin, which simply moves a device from the
    host network namespace
  - Portmap now uses a more efficient rule structure
  - host-local can receive ranges as a RuntimeArgument
  - DHCP daemon can be containerized
  - DHCP now correctly parses routes
  - Various Windows build fixes
  - Waiting for DAD is skipped when possible
  - Bridge now uses a stable mac
  - Fix a regression where the interface's MAC address was no
    longer populated in the return type.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558353600">- Updated plugins to v0.8.0:
  + New plugins:
  * bandwidth - limit incoming and outgoing bandwidth
  * firewall - add containers to firewall rules
  * sbr - convert container routes to source-based routes
  * static - assign a fixed IP address
  * win-bridge, win-overlay: Windows plugins
  + Plugin features / changelog:
  * CHECK Support
  * macvlan:
  - Allow to configure empty ipam for macvlan
  - Make master config optional
  * bridge:
  - Add vlan tag to the bridge cni plugin
  - Allow the user to assign VLAN tag
  - L2 bridge Implementation.
  * dhcp:
  - Include Subnet Mask option parameter in DHCPREQUEST
  - Add systemd unit file to activate socket with systemd
  - Add container ifName to the dhcp clientID, making the
    clientID value
  * flannel:
  - Pass through runtimeConfig to delegate
  * host-local:
  - host-local: add ifname to file tracking IP address used
  * host-device:
  - Support the IPAM in the host-device
  - Handle empty netns in DEL for loopback and host-device
  * tuning:
  - adds 'ip link' command related feature into tuning
  + Bug fixes &amp; minor changes
  * Correctly DEL on ipam failure for all plugins
  * Fix bug on ip revert if cmdAdd fails on macvlan and host-device
  * host-device: Ensure device is down before rename
  * Fix -hostprefix option
  * some DHCP servers expect to request for explicit router options
  * bridge: release IP in case of error
  * change source of ipmasq rule from ipn to ip
  + Build fixes:
  * test: add coveralls support
  * plugins: correctly output build version, cosmetic cleanups
  * Move Windows tests to Travis
- from version v0.7.5:
  + This release takes a minor change to the portmap plugin:
  * Portmap: append, rather than prepend, entry rules
  + This fixes a potential issue where firewall rules may
    be bypassed by port mapping
- Include patch to fix the build on i586:
  + 0001_use_Go_facilities_to_get_a_socket.patch
- Use new build_linux.sh script instead of removed build.sh</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1559822400">- Updated plugins to v0.8.1:
  + Bugs:
  * bridge: fix ipMasq setup to use correct source address
  * fix compilation error on 386
  * bandwidth: get bandwidth interface in host ns through
    container interface
  + Improvements:
  * Release: bump go to v1.12
  * host-device: add pciBusID property
- Drop patches merged upstream:
  + 0001_use_Go_facilities_to_get_a_socket.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1565956800">- Update plugins to v0.8.2
  + New features:
  * Support "args" in static and tuning
  * Add Loopback DSR support, allow l2tunnel networks
    to be used with the l2bridge plugin
  * host-local: return error if same ADD request is seen twice
  * bandwidth: fix collisions
  * Support ips capability in static and mac capability in tuning
  * pkg/veth: Make host-side veth name configurable
  + Bug fixes:
  * Fix: failed to set bridge addr: could not add IP address to "cni0": file exists
  * host-device: revert name setting to make retries idempotent (#357).
  * Vendor update go-iptables. Vendor update go-iptables to
    obtain commit f1d0510cabcb710d5c5dd284096f81444b9d8d10
  * Update go.mod &amp; go.sub
  * Remove link Down/Up in MAC address change to prevent route flush (#364).
  * pkg/ip unit test: be agnostic of Linux version, on Linux 4.4 the syscall
    error message is "invalid argument" not "file exists"
  * bump containernetworking/cni to v0.7.1</changelog>
  <changelog author="sgrunert@suse.com" date="1573473600">- Update to version 0.8.3:
  * Enhancements:
  * static: prioritize the input sources for IPs (#400).
  * tuning: send gratuitous ARP in case of MAC address update (#403).
  * bandwidth: use uint64 for Bandwidth value (#389).
  * ptp: only override DNS conf if DNS settings provided (#388).
  * loopback: When prevResults are not supplied to loopback plugin, create results to return (#383).
  * loopback support CNI CHECK and result cache (#374).
  * Better input validation:
  * vlan: add MTU validation to loadNetConf (#405).
  * macvlan: add MTU validation to loadNetConf (#404).
  * bridge: check vlan id when loading net conf (#394).
  * Bugfixes:
  * bugfix: defer after err check, or it may panic (#391).
  * portmap: Fix dual-stack support (#379).
  * firewall: don't return error in DEL if prevResult is not found (#390).
  * bump up libcni back to v0.7.1 (#377).
  * Tests:
  * integration: fix ip address collision in integration tests (#409).
  * testutils: newNS() works in a rootless user namespace (#401).
  * Bump Go version (#386).
  * Cleanup netns after test suite (#375).
  * Docs:
  * contributing doc: revise test script name to run (#396).
  * contributing doc: describe cnitool installation (#397).</changelog>
  <changelog author="sgrunert@suse.com" date="1578571200">- Update to version 0.8.4 (bsc#1160460):
  * add support for mips64le
  * Add missing cniVersion in README example
  * bump go-iptables module to v0.4.5
  * iptables: add idempotent functions
  * portmap doesn't fail if chain doesn't exist
  * fix portmap port forward flakiness
  * Add Bruce Ma and Piotr Skarmuk as owners</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- Update to version 0.8.6 (bsc#1172410 CVE-2020-10749)
  * New features
  * Support device id in host device plugin (#471).
  * win-bridge: add support for portMappings capability (#475).
  * Make host-device to work with virtio net device (#453).
  * Small improvements
  * ptp, bridge: disable accept_ra on the host-side interface (#484).
  * modify the error url of windowscontainer (#460).
  * portmap: Apply the DNAT hairpin to the whole subnet (#469). The DNAT hairpin
    rule only allow the * container itself to access the ports it is exposing thru
    the host IP. Other containers in the same subnet might also want to access this
    service via the host IP, so apply this rule to the whole subnet instead of just
    for the container.
  * Unlock OS thread after netns is restored (#455).
  * Bugfixes
  * plugins/meta/sbr: Adjusted ipv6 address mask to /128 (#479). A /64 mask was used
    which routed an entire cidr based on source, not only the bound address.
  * check bridge's port state (#468). fix #463
  * Reset the route flag before moving the rule (#472).
  * replace juju/errors because of CNCF license scan (#458). ref to #457
  * loopback: Fix ipv6 address checks (#442). Fixes a minor bug in loopback plugin.
    The IPv6 address check loops over IPv4 addresses.
- from version 0.8.5
  * Bugfixes
  * bridge: Fix for the case where kernel doesn't have CONFIG_BRIDGE_VLAN_FILTERING
    (#434) fixes #370.
  * vlan: Fix vlan plugin returning error when device is already removed (#438).
  * Improvements
  * sysctl: Improve support of sysctl name separators (#437).</changelog>
  <changelog author="dmueller@suse.com" date="1598875200">- Update to version 0.8.7:
  * Fix race condition in GetCurrentNS
  * lo: CNI_IFNAME is no longer ignored
  * cni: bump to 0.8.0
  * Bump Go version to 1.13 and 1.14
  * Add contact info
  * Update firewall README.md CNI-ADMIN
  * firewall: fix some typos in docs
  * portmap DEL noop if no portMappings present
  * flannel: remove net conf file after DEL succeed</changelog>
  <changelog author="rbrown@suse.com" date="1610107200">- Update to version 0.9.0:
  * tuning: revert values on delete (#540)
  * go mod tidy
  * bump to go 1.15
  * Add ability to trigger retests via comments
  * pkg/ns: fix test case to tolerate pids going away.
  * Add github build &amp; test actions
  * bridge: fix testcase to check addresses we care about
  * Remove travis.
  * vendor: bump ginkgo, gover
  * portmap plugin should flush previous udp connections
  * Updating plugin README.md files (#549)
  * update netlink dependencies
  * Xdhcp: fix example configuration
  * VRF: extend supported version to 0.3.1 too.
  * VRF CNI: Add an optional table parameter.
  * Add more tests for the vrf cni plugin.
  * Update github.com/vishvananda/netlink to v1.1.0
  * Introduce a new VRF CNI meta plugin.
  * Travis: run tests on arm64
  * Replace nc with the local echo client.
  * Add an echo client to be used instead of nc.
  * Bump up the ubuntu version used in CI to bionic.
  * flannel: allow input ipam parameters as basis for delegate
  * ipvlan: make master config as optional
  * Remove extraneous test file in Windows plugin</changelog>
  <changelog author="rpm@fthiessen.de" date="1619438400">- Update to version 0.9.1:
  * ipam/dhcp: Add broadcast flag
  * add flannel to support dual stack ip
  * bandwidth: fix panic in tests
  * host-device: Add support for DPDK device
  * [main/vlan] Fix error handling for delegate IPAM plugin
  * dhcp: default dhcp clien timeout is 10s
  * vlan: fix error message text by removing ptp references
  * dhcp: daemon dhcp client timeout is configurable
  * dhcp: timeout value is set in DHCP daemon
  * remove unused function
  * deps: go mod tidy coreos/go-iptables
  * deps: bump coreos/go-iptables</changelog>
  <changelog author="fvogt@suse.com" date="1648555200">- Update to version 1.1.1:
  * ipam/dhcp: Fix client id in renew/release
  * call ipam.ExceDel after clean up device in netns fix #666
  * portmap: fix checkPorts result when chain does not exist
  * portmap: fix bug that new udp connection deletes all existing conntrack entries
  * Enhanced dad set to 1
  * Add boolean to enable/disable dad
  * Disable DAD for container side veth
  * firewall: support ingressPolicy=(open|same-bridge) for isolating bridges as in Docker
  * Fix host-device gofmt
  * host-device: Bring interfaces up after moving into container
  * pkg/ns: use file system magic numbers from golang.org/x/sys/unix
  * gofmt
  * go mod tidy
  * build: bump to go 1.17
  * Remove arp notify setting per comment
  * plugins: replace arping package with arp_notify
  * fix #685
  * Ran go fmt so tests would pass
  * Fixed DHCP problem that broke when fast retry was added.
  * dhcp ipam: adjust retry mechanism
  * add ipam tests for dpdk device
  * add ipam support for dpdk device
  * ipvlan: Send Gratuitous ARP after IPs are set
  * dhcp ipam: fix client id
  * dhcp ipam: rename inconsistent options among files
  * dhcp ipam: add more options capable for sending
  * dhcp ipam: add fast retry
  * dhcp ipam: support customizing dhcp options
  * dhcp ipam: truncate client id to 254 bytes
  * dhcp ipam: print error correctly without format string
  * dhcp ipam: using full config to regular the code
  * Allow setting sysctls on a particular interface
  * dhcp: remove implemented TODO
  * Don't redundantly filepath.Clean the output of filepath.Join
  * Use crypto/rand.Read, not crypto.Reader.Read
  * bridge: Add macspoofchk support
  * plugins: fix bug where support for CNI version 0.4.0 or 1.0.0 was dropped
  * vendor: bump to libcni v1.0.1
  * static ipam: do not parse the CIDR twice
  * static ipam: improve error msgs when provisioning invalid CIDR
  * bump go to 1.16, other misc fixes
  * vendor: bump all direct dependencies
  * vendor: bump to libcni v1.0
  * docs: Update the CI badge from Travis CI to GitHub Actions
  * bridge: Fix typo in error message for promiscuous mode
  * ip: place veth peer in host namspace directly
  * bridge: Add mac field to specify container iface mac
  * static ipam: decide wrong cidr error msg
  * static ipam: stop wrapping net.ParseCIDR errors
  * static ipam: show confusing error msg
  * utils, hwaddr: Remove unused package
  * ip, link_linux: Remove unused SetHWAddrByIP function
  * plugins: remove flannel
  * refactor(win-bridge): netconf
  * refactor(win-bridge): hcn api processing
  * refactor(win-bridge): hns api processing
  * chore(win-bridge): location related
  * chore(win-bridge): text related
  * Remove Bryan Boreham as maintainer
  * host-local: support ip/prefix in env args and CNI args
  * [sbr]: Use different tableID for every ipCfg        Check tableID not in use for every ipCfg
  * Small typo improves in README.md
  * Allow multiple routes to be added for the same prefix. Enables ECMP
  * Update to lastest vendor/github.com/vishvananda/netlink
  * tuning: always update MAC in CNI result
  * vendor: bump to libcni v1.0-rc1
  * tuning: Add support of altering the allmulticast flag
  * [sbr]: Use different tableID for every ipCfg        Move default table routes which  match the ipCfg config
  * Fix nil-pointer check
  * host-local: support custom IPs allocation through runtime configuration
  * pkg/ip: introduce a new type `IP` to support formated &lt;ip&gt;[/&lt;prefix&gt;]
  * go.mod: github.com/j-keck/arping v1.0.1
  * go.mod: github.com/buger/jsonparser v1.1.1
  * go.mod: github.com/alexflint/go-filemutex v1.1.0
  * go.mod github.com/Microsoft/hcsshim v0.8.16
  * go.mod: godbus/dbus/v5 v5.0.3, coreos/go-systemd v22.2.0
  * go.mod: github.com/mattn/go-shellwords v1.0.11
  * go.mod: github.com/sirupsen/logrus v1.8.1
  * CI: Install linux-modules-extra for VRF module
  * Fix broken links to online docs in plugin READMEs
  * gha: update actions/setup-go@v2
  * remove redundant startRange in RangeIter due to overlap check on multi ranges
  * fix(win-bridge): panic while calling HNS api
  * portmap: use slashes in sysctl template to support interface names which separated by dots
  * pkg/ipam: use slash as sysctl separator so interface name can have dot
  * [macvlan] Stop setting proxy-arp on macvlan interface
  * tuning: increase test coverage to 1.0.0 and older spec versions
  * portmap: increase test coverage to 1.0.0 and older spec versions
  * flannel: increase test coverage to 1.0.0 and older spec versions
  * firewall: increase test coverage to 1.0.0 and older spec versions
  * bandwidth: increase test coverage to 1.0.0 and older spec versions
  * host-local: increase test coverage to 1.0.0 and older spec versions
  * static: increase test coverage to 1.0.0 and older spec versions
  * dhcp: increase test coverage to 1.0.0 and older spec versions
  * dhcp: add -resendmax option to limit lease acquisition time for testcases
  * vlan: increase test coverage to 1.0.0 and older spec versions
  * ptp: increase test coverage to 1.0.0 and older spec versions
  * macvlan: increase test coverage to 1.0.0 and older spec versions
  * loopback: increase test coverage to 1.0.0 and older spec versions
  * ipvlan: increase test coverage to 1.0.0 and older spec versions
  * host-device: increase test coverage to 1.0.0 and older spec versions
  * bridge: increase test coverage to 1.0.0 and older spec versions
  * bridge: simplify version-based testcase code
  * testutils: add test utilities for spec version features
  * plugins: update to spec version 1.0.0
  * vendor: bump CNI to 1.0.0-pre @ 62e54113 (fixes bsc#1181961 aka CVE-2021-20206)
- Drop %go_nostrip</changelog>
</package>
<package pkgid="2fddc8f6d35dbe412febaab71ce5f081244f9e9d3f5667c3a2bda5e85710e849" name="cni-plugins" arch="s390x">
  <version epoch="0" ver="1.1.1" rel="150500.3.2.1"/>
  <changelog author="alvaro.saurin@suse.com" date="1503921600">- Initial version from CNI plugins v0.6.0</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1503921601">- Install docs in the cni-plugins dir</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1513684800">- Require cni</changelog>
  <changelog author="dcassany@suse.com" date="1528113600">- Make use of %license macro</changelog>
  <changelog author="dcassany@suse.com" date="1528200000">- Refactor %license usage to a simpler form</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1544616000">- Updated to a supported version of Go (due to security reasons)</changelog>
  <changelog author="sgrunert@suse.com" date="1548417600">- Updated plugins to v0.7.4:
  - Add host-device plugin, which simply moves a device from the
    host network namespace
  - Portmap now uses a more efficient rule structure
  - host-local can receive ranges as a RuntimeArgument
  - DHCP daemon can be containerized
  - DHCP now correctly parses routes
  - Various Windows build fixes
  - Waiting for DAD is skipped when possible
  - Bridge now uses a stable mac
  - Fix a regression where the interface's MAC address was no
    longer populated in the return type.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558353600">- Updated plugins to v0.8.0:
  + New plugins:
  * bandwidth - limit incoming and outgoing bandwidth
  * firewall - add containers to firewall rules
  * sbr - convert container routes to source-based routes
  * static - assign a fixed IP address
  * win-bridge, win-overlay: Windows plugins
  + Plugin features / changelog:
  * CHECK Support
  * macvlan:
  - Allow to configure empty ipam for macvlan
  - Make master config optional
  * bridge:
  - Add vlan tag to the bridge cni plugin
  - Allow the user to assign VLAN tag
  - L2 bridge Implementation.
  * dhcp:
  - Include Subnet Mask option parameter in DHCPREQUEST
  - Add systemd unit file to activate socket with systemd
  - Add container ifName to the dhcp clientID, making the
    clientID value
  * flannel:
  - Pass through runtimeConfig to delegate
  * host-local:
  - host-local: add ifname to file tracking IP address used
  * host-device:
  - Support the IPAM in the host-device
  - Handle empty netns in DEL for loopback and host-device
  * tuning:
  - adds 'ip link' command related feature into tuning
  + Bug fixes &amp; minor changes
  * Correctly DEL on ipam failure for all plugins
  * Fix bug on ip revert if cmdAdd fails on macvlan and host-device
  * host-device: Ensure device is down before rename
  * Fix -hostprefix option
  * some DHCP servers expect to request for explicit router options
  * bridge: release IP in case of error
  * change source of ipmasq rule from ipn to ip
  + Build fixes:
  * test: add coveralls support
  * plugins: correctly output build version, cosmetic cleanups
  * Move Windows tests to Travis
- from version v0.7.5:
  + This release takes a minor change to the portmap plugin:
  * Portmap: append, rather than prepend, entry rules
  + This fixes a potential issue where firewall rules may
    be bypassed by port mapping
- Include patch to fix the build on i586:
  + 0001_use_Go_facilities_to_get_a_socket.patch
- Use new build_linux.sh script instead of removed build.sh</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1559822400">- Updated plugins to v0.8.1:
  + Bugs:
  * bridge: fix ipMasq setup to use correct source address
  * fix compilation error on 386
  * bandwidth: get bandwidth interface in host ns through
    container interface
  + Improvements:
  * Release: bump go to v1.12
  * host-device: add pciBusID property
- Drop patches merged upstream:
  + 0001_use_Go_facilities_to_get_a_socket.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1565956800">- Update plugins to v0.8.2
  + New features:
  * Support "args" in static and tuning
  * Add Loopback DSR support, allow l2tunnel networks
    to be used with the l2bridge plugin
  * host-local: return error if same ADD request is seen twice
  * bandwidth: fix collisions
  * Support ips capability in static and mac capability in tuning
  * pkg/veth: Make host-side veth name configurable
  + Bug fixes:
  * Fix: failed to set bridge addr: could not add IP address to "cni0": file exists
  * host-device: revert name setting to make retries idempotent (#357).
  * Vendor update go-iptables. Vendor update go-iptables to
    obtain commit f1d0510cabcb710d5c5dd284096f81444b9d8d10
  * Update go.mod &amp; go.sub
  * Remove link Down/Up in MAC address change to prevent route flush (#364).
  * pkg/ip unit test: be agnostic of Linux version, on Linux 4.4 the syscall
    error message is "invalid argument" not "file exists"
  * bump containernetworking/cni to v0.7.1</changelog>
  <changelog author="sgrunert@suse.com" date="1573473600">- Update to version 0.8.3:
  * Enhancements:
  * static: prioritize the input sources for IPs (#400).
  * tuning: send gratuitous ARP in case of MAC address update (#403).
  * bandwidth: use uint64 for Bandwidth value (#389).
  * ptp: only override DNS conf if DNS settings provided (#388).
  * loopback: When prevResults are not supplied to loopback plugin, create results to return (#383).
  * loopback support CNI CHECK and result cache (#374).
  * Better input validation:
  * vlan: add MTU validation to loadNetConf (#405).
  * macvlan: add MTU validation to loadNetConf (#404).
  * bridge: check vlan id when loading net conf (#394).
  * Bugfixes:
  * bugfix: defer after err check, or it may panic (#391).
  * portmap: Fix dual-stack support (#379).
  * firewall: don't return error in DEL if prevResult is not found (#390).
  * bump up libcni back to v0.7.1 (#377).
  * Tests:
  * integration: fix ip address collision in integration tests (#409).
  * testutils: newNS() works in a rootless user namespace (#401).
  * Bump Go version (#386).
  * Cleanup netns after test suite (#375).
  * Docs:
  * contributing doc: revise test script name to run (#396).
  * contributing doc: describe cnitool installation (#397).</changelog>
  <changelog author="sgrunert@suse.com" date="1578571200">- Update to version 0.8.4 (bsc#1160460):
  * add support for mips64le
  * Add missing cniVersion in README example
  * bump go-iptables module to v0.4.5
  * iptables: add idempotent functions
  * portmap doesn't fail if chain doesn't exist
  * fix portmap port forward flakiness
  * Add Bruce Ma and Piotr Skarmuk as owners</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- Update to version 0.8.6 (bsc#1172410 CVE-2020-10749)
  * New features
  * Support device id in host device plugin (#471).
  * win-bridge: add support for portMappings capability (#475).
  * Make host-device to work with virtio net device (#453).
  * Small improvements
  * ptp, bridge: disable accept_ra on the host-side interface (#484).
  * modify the error url of windowscontainer (#460).
  * portmap: Apply the DNAT hairpin to the whole subnet (#469). The DNAT hairpin
    rule only allow the * container itself to access the ports it is exposing thru
    the host IP. Other containers in the same subnet might also want to access this
    service via the host IP, so apply this rule to the whole subnet instead of just
    for the container.
  * Unlock OS thread after netns is restored (#455).
  * Bugfixes
  * plugins/meta/sbr: Adjusted ipv6 address mask to /128 (#479). A /64 mask was used
    which routed an entire cidr based on source, not only the bound address.
  * check bridge's port state (#468). fix #463
  * Reset the route flag before moving the rule (#472).
  * replace juju/errors because of CNCF license scan (#458). ref to #457
  * loopback: Fix ipv6 address checks (#442). Fixes a minor bug in loopback plugin.
    The IPv6 address check loops over IPv4 addresses.
- from version 0.8.5
  * Bugfixes
  * bridge: Fix for the case where kernel doesn't have CONFIG_BRIDGE_VLAN_FILTERING
    (#434) fixes #370.
  * vlan: Fix vlan plugin returning error when device is already removed (#438).
  * Improvements
  * sysctl: Improve support of sysctl name separators (#437).</changelog>
  <changelog author="dmueller@suse.com" date="1598875200">- Update to version 0.8.7:
  * Fix race condition in GetCurrentNS
  * lo: CNI_IFNAME is no longer ignored
  * cni: bump to 0.8.0
  * Bump Go version to 1.13 and 1.14
  * Add contact info
  * Update firewall README.md CNI-ADMIN
  * firewall: fix some typos in docs
  * portmap DEL noop if no portMappings present
  * flannel: remove net conf file after DEL succeed</changelog>
  <changelog author="rbrown@suse.com" date="1610107200">- Update to version 0.9.0:
  * tuning: revert values on delete (#540)
  * go mod tidy
  * bump to go 1.15
  * Add ability to trigger retests via comments
  * pkg/ns: fix test case to tolerate pids going away.
  * Add github build &amp; test actions
  * bridge: fix testcase to check addresses we care about
  * Remove travis.
  * vendor: bump ginkgo, gover
  * portmap plugin should flush previous udp connections
  * Updating plugin README.md files (#549)
  * update netlink dependencies
  * Xdhcp: fix example configuration
  * VRF: extend supported version to 0.3.1 too.
  * VRF CNI: Add an optional table parameter.
  * Add more tests for the vrf cni plugin.
  * Update github.com/vishvananda/netlink to v1.1.0
  * Introduce a new VRF CNI meta plugin.
  * Travis: run tests on arm64
  * Replace nc with the local echo client.
  * Add an echo client to be used instead of nc.
  * Bump up the ubuntu version used in CI to bionic.
  * flannel: allow input ipam parameters as basis for delegate
  * ipvlan: make master config as optional
  * Remove extraneous test file in Windows plugin</changelog>
  <changelog author="rpm@fthiessen.de" date="1619438400">- Update to version 0.9.1:
  * ipam/dhcp: Add broadcast flag
  * add flannel to support dual stack ip
  * bandwidth: fix panic in tests
  * host-device: Add support for DPDK device
  * [main/vlan] Fix error handling for delegate IPAM plugin
  * dhcp: default dhcp clien timeout is 10s
  * vlan: fix error message text by removing ptp references
  * dhcp: daemon dhcp client timeout is configurable
  * dhcp: timeout value is set in DHCP daemon
  * remove unused function
  * deps: go mod tidy coreos/go-iptables
  * deps: bump coreos/go-iptables</changelog>
  <changelog author="fvogt@suse.com" date="1648555200">- Update to version 1.1.1:
  * ipam/dhcp: Fix client id in renew/release
  * call ipam.ExceDel after clean up device in netns fix #666
  * portmap: fix checkPorts result when chain does not exist
  * portmap: fix bug that new udp connection deletes all existing conntrack entries
  * Enhanced dad set to 1
  * Add boolean to enable/disable dad
  * Disable DAD for container side veth
  * firewall: support ingressPolicy=(open|same-bridge) for isolating bridges as in Docker
  * Fix host-device gofmt
  * host-device: Bring interfaces up after moving into container
  * pkg/ns: use file system magic numbers from golang.org/x/sys/unix
  * gofmt
  * go mod tidy
  * build: bump to go 1.17
  * Remove arp notify setting per comment
  * plugins: replace arping package with arp_notify
  * fix #685
  * Ran go fmt so tests would pass
  * Fixed DHCP problem that broke when fast retry was added.
  * dhcp ipam: adjust retry mechanism
  * add ipam tests for dpdk device
  * add ipam support for dpdk device
  * ipvlan: Send Gratuitous ARP after IPs are set
  * dhcp ipam: fix client id
  * dhcp ipam: rename inconsistent options among files
  * dhcp ipam: add more options capable for sending
  * dhcp ipam: add fast retry
  * dhcp ipam: support customizing dhcp options
  * dhcp ipam: truncate client id to 254 bytes
  * dhcp ipam: print error correctly without format string
  * dhcp ipam: using full config to regular the code
  * Allow setting sysctls on a particular interface
  * dhcp: remove implemented TODO
  * Don't redundantly filepath.Clean the output of filepath.Join
  * Use crypto/rand.Read, not crypto.Reader.Read
  * bridge: Add macspoofchk support
  * plugins: fix bug where support for CNI version 0.4.0 or 1.0.0 was dropped
  * vendor: bump to libcni v1.0.1
  * static ipam: do not parse the CIDR twice
  * static ipam: improve error msgs when provisioning invalid CIDR
  * bump go to 1.16, other misc fixes
  * vendor: bump all direct dependencies
  * vendor: bump to libcni v1.0
  * docs: Update the CI badge from Travis CI to GitHub Actions
  * bridge: Fix typo in error message for promiscuous mode
  * ip: place veth peer in host namspace directly
  * bridge: Add mac field to specify container iface mac
  * static ipam: decide wrong cidr error msg
  * static ipam: stop wrapping net.ParseCIDR errors
  * static ipam: show confusing error msg
  * utils, hwaddr: Remove unused package
  * ip, link_linux: Remove unused SetHWAddrByIP function
  * plugins: remove flannel
  * refactor(win-bridge): netconf
  * refactor(win-bridge): hcn api processing
  * refactor(win-bridge): hns api processing
  * chore(win-bridge): location related
  * chore(win-bridge): text related
  * Remove Bryan Boreham as maintainer
  * host-local: support ip/prefix in env args and CNI args
  * [sbr]: Use different tableID for every ipCfg        Check tableID not in use for every ipCfg
  * Small typo improves in README.md
  * Allow multiple routes to be added for the same prefix. Enables ECMP
  * Update to lastest vendor/github.com/vishvananda/netlink
  * tuning: always update MAC in CNI result
  * vendor: bump to libcni v1.0-rc1
  * tuning: Add support of altering the allmulticast flag
  * [sbr]: Use different tableID for every ipCfg        Move default table routes which  match the ipCfg config
  * Fix nil-pointer check
  * host-local: support custom IPs allocation through runtime configuration
  * pkg/ip: introduce a new type `IP` to support formated &lt;ip&gt;[/&lt;prefix&gt;]
  * go.mod: github.com/j-keck/arping v1.0.1
  * go.mod: github.com/buger/jsonparser v1.1.1
  * go.mod: github.com/alexflint/go-filemutex v1.1.0
  * go.mod github.com/Microsoft/hcsshim v0.8.16
  * go.mod: godbus/dbus/v5 v5.0.3, coreos/go-systemd v22.2.0
  * go.mod: github.com/mattn/go-shellwords v1.0.11
  * go.mod: github.com/sirupsen/logrus v1.8.1
  * CI: Install linux-modules-extra for VRF module
  * Fix broken links to online docs in plugin READMEs
  * gha: update actions/setup-go@v2
  * remove redundant startRange in RangeIter due to overlap check on multi ranges
  * fix(win-bridge): panic while calling HNS api
  * portmap: use slashes in sysctl template to support interface names which separated by dots
  * pkg/ipam: use slash as sysctl separator so interface name can have dot
  * [macvlan] Stop setting proxy-arp on macvlan interface
  * tuning: increase test coverage to 1.0.0 and older spec versions
  * portmap: increase test coverage to 1.0.0 and older spec versions
  * flannel: increase test coverage to 1.0.0 and older spec versions
  * firewall: increase test coverage to 1.0.0 and older spec versions
  * bandwidth: increase test coverage to 1.0.0 and older spec versions
  * host-local: increase test coverage to 1.0.0 and older spec versions
  * static: increase test coverage to 1.0.0 and older spec versions
  * dhcp: increase test coverage to 1.0.0 and older spec versions
  * dhcp: add -resendmax option to limit lease acquisition time for testcases
  * vlan: increase test coverage to 1.0.0 and older spec versions
  * ptp: increase test coverage to 1.0.0 and older spec versions
  * macvlan: increase test coverage to 1.0.0 and older spec versions
  * loopback: increase test coverage to 1.0.0 and older spec versions
  * ipvlan: increase test coverage to 1.0.0 and older spec versions
  * host-device: increase test coverage to 1.0.0 and older spec versions
  * bridge: increase test coverage to 1.0.0 and older spec versions
  * bridge: simplify version-based testcase code
  * testutils: add test utilities for spec version features
  * plugins: update to spec version 1.0.0
  * vendor: bump CNI to 1.0.0-pre @ 62e54113 (fixes bsc#1181961 aka CVE-2021-20206)
- Drop %go_nostrip</changelog>
</package>
<package pkgid="2231ae77ef458ceb11f23fc4f1cc8b5427bd3c422ce19ff94ad99105d0cadfa0" name="cni-plugins" arch="src">
  <version epoch="0" ver="1.1.1" rel="150500.3.2.1"/>
  <changelog author="alvaro.saurin@suse.com" date="1503921600">- Initial version from CNI plugins v0.6.0</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1503921601">- Install docs in the cni-plugins dir</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1513684800">- Require cni</changelog>
  <changelog author="dcassany@suse.com" date="1528113600">- Make use of %license macro</changelog>
  <changelog author="dcassany@suse.com" date="1528200000">- Refactor %license usage to a simpler form</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1544616000">- Updated to a supported version of Go (due to security reasons)</changelog>
  <changelog author="sgrunert@suse.com" date="1548417600">- Updated plugins to v0.7.4:
  - Add host-device plugin, which simply moves a device from the
    host network namespace
  - Portmap now uses a more efficient rule structure
  - host-local can receive ranges as a RuntimeArgument
  - DHCP daemon can be containerized
  - DHCP now correctly parses routes
  - Various Windows build fixes
  - Waiting for DAD is skipped when possible
  - Bridge now uses a stable mac
  - Fix a regression where the interface's MAC address was no
    longer populated in the return type.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558353600">- Updated plugins to v0.8.0:
  + New plugins:
  * bandwidth - limit incoming and outgoing bandwidth
  * firewall - add containers to firewall rules
  * sbr - convert container routes to source-based routes
  * static - assign a fixed IP address
  * win-bridge, win-overlay: Windows plugins
  + Plugin features / changelog:
  * CHECK Support
  * macvlan:
  - Allow to configure empty ipam for macvlan
  - Make master config optional
  * bridge:
  - Add vlan tag to the bridge cni plugin
  - Allow the user to assign VLAN tag
  - L2 bridge Implementation.
  * dhcp:
  - Include Subnet Mask option parameter in DHCPREQUEST
  - Add systemd unit file to activate socket with systemd
  - Add container ifName to the dhcp clientID, making the
    clientID value
  * flannel:
  - Pass through runtimeConfig to delegate
  * host-local:
  - host-local: add ifname to file tracking IP address used
  * host-device:
  - Support the IPAM in the host-device
  - Handle empty netns in DEL for loopback and host-device
  * tuning:
  - adds 'ip link' command related feature into tuning
  + Bug fixes &amp; minor changes
  * Correctly DEL on ipam failure for all plugins
  * Fix bug on ip revert if cmdAdd fails on macvlan and host-device
  * host-device: Ensure device is down before rename
  * Fix -hostprefix option
  * some DHCP servers expect to request for explicit router options
  * bridge: release IP in case of error
  * change source of ipmasq rule from ipn to ip
  + Build fixes:
  * test: add coveralls support
  * plugins: correctly output build version, cosmetic cleanups
  * Move Windows tests to Travis
- from version v0.7.5:
  + This release takes a minor change to the portmap plugin:
  * Portmap: append, rather than prepend, entry rules
  + This fixes a potential issue where firewall rules may
    be bypassed by port mapping
- Include patch to fix the build on i586:
  + 0001_use_Go_facilities_to_get_a_socket.patch
- Use new build_linux.sh script instead of removed build.sh</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1559822400">- Updated plugins to v0.8.1:
  + Bugs:
  * bridge: fix ipMasq setup to use correct source address
  * fix compilation error on 386
  * bandwidth: get bandwidth interface in host ns through
    container interface
  + Improvements:
  * Release: bump go to v1.12
  * host-device: add pciBusID property
- Drop patches merged upstream:
  + 0001_use_Go_facilities_to_get_a_socket.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1565956800">- Update plugins to v0.8.2
  + New features:
  * Support "args" in static and tuning
  * Add Loopback DSR support, allow l2tunnel networks
    to be used with the l2bridge plugin
  * host-local: return error if same ADD request is seen twice
  * bandwidth: fix collisions
  * Support ips capability in static and mac capability in tuning
  * pkg/veth: Make host-side veth name configurable
  + Bug fixes:
  * Fix: failed to set bridge addr: could not add IP address to "cni0": file exists
  * host-device: revert name setting to make retries idempotent (#357).
  * Vendor update go-iptables. Vendor update go-iptables to
    obtain commit f1d0510cabcb710d5c5dd284096f81444b9d8d10
  * Update go.mod &amp; go.sub
  * Remove link Down/Up in MAC address change to prevent route flush (#364).
  * pkg/ip unit test: be agnostic of Linux version, on Linux 4.4 the syscall
    error message is "invalid argument" not "file exists"
  * bump containernetworking/cni to v0.7.1</changelog>
  <changelog author="sgrunert@suse.com" date="1573473600">- Update to version 0.8.3:
  * Enhancements:
  * static: prioritize the input sources for IPs (#400).
  * tuning: send gratuitous ARP in case of MAC address update (#403).
  * bandwidth: use uint64 for Bandwidth value (#389).
  * ptp: only override DNS conf if DNS settings provided (#388).
  * loopback: When prevResults are not supplied to loopback plugin, create results to return (#383).
  * loopback support CNI CHECK and result cache (#374).
  * Better input validation:
  * vlan: add MTU validation to loadNetConf (#405).
  * macvlan: add MTU validation to loadNetConf (#404).
  * bridge: check vlan id when loading net conf (#394).
  * Bugfixes:
  * bugfix: defer after err check, or it may panic (#391).
  * portmap: Fix dual-stack support (#379).
  * firewall: don't return error in DEL if prevResult is not found (#390).
  * bump up libcni back to v0.7.1 (#377).
  * Tests:
  * integration: fix ip address collision in integration tests (#409).
  * testutils: newNS() works in a rootless user namespace (#401).
  * Bump Go version (#386).
  * Cleanup netns after test suite (#375).
  * Docs:
  * contributing doc: revise test script name to run (#396).
  * contributing doc: describe cnitool installation (#397).</changelog>
  <changelog author="sgrunert@suse.com" date="1578571200">- Update to version 0.8.4 (bsc#1160460):
  * add support for mips64le
  * Add missing cniVersion in README example
  * bump go-iptables module to v0.4.5
  * iptables: add idempotent functions
  * portmap doesn't fail if chain doesn't exist
  * fix portmap port forward flakiness
  * Add Bruce Ma and Piotr Skarmuk as owners</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- Update to version 0.8.6 (bsc#1172410 CVE-2020-10749)
  * New features
  * Support device id in host device plugin (#471).
  * win-bridge: add support for portMappings capability (#475).
  * Make host-device to work with virtio net device (#453).
  * Small improvements
  * ptp, bridge: disable accept_ra on the host-side interface (#484).
  * modify the error url of windowscontainer (#460).
  * portmap: Apply the DNAT hairpin to the whole subnet (#469). The DNAT hairpin
    rule only allow the * container itself to access the ports it is exposing thru
    the host IP. Other containers in the same subnet might also want to access this
    service via the host IP, so apply this rule to the whole subnet instead of just
    for the container.
  * Unlock OS thread after netns is restored (#455).
  * Bugfixes
  * plugins/meta/sbr: Adjusted ipv6 address mask to /128 (#479). A /64 mask was used
    which routed an entire cidr based on source, not only the bound address.
  * check bridge's port state (#468). fix #463
  * Reset the route flag before moving the rule (#472).
  * replace juju/errors because of CNCF license scan (#458). ref to #457
  * loopback: Fix ipv6 address checks (#442). Fixes a minor bug in loopback plugin.
    The IPv6 address check loops over IPv4 addresses.
- from version 0.8.5
  * Bugfixes
  * bridge: Fix for the case where kernel doesn't have CONFIG_BRIDGE_VLAN_FILTERING
    (#434) fixes #370.
  * vlan: Fix vlan plugin returning error when device is already removed (#438).
  * Improvements
  * sysctl: Improve support of sysctl name separators (#437).</changelog>
  <changelog author="dmueller@suse.com" date="1598875200">- Update to version 0.8.7:
  * Fix race condition in GetCurrentNS
  * lo: CNI_IFNAME is no longer ignored
  * cni: bump to 0.8.0
  * Bump Go version to 1.13 and 1.14
  * Add contact info
  * Update firewall README.md CNI-ADMIN
  * firewall: fix some typos in docs
  * portmap DEL noop if no portMappings present
  * flannel: remove net conf file after DEL succeed</changelog>
  <changelog author="rbrown@suse.com" date="1610107200">- Update to version 0.9.0:
  * tuning: revert values on delete (#540)
  * go mod tidy
  * bump to go 1.15
  * Add ability to trigger retests via comments
  * pkg/ns: fix test case to tolerate pids going away.
  * Add github build &amp; test actions
  * bridge: fix testcase to check addresses we care about
  * Remove travis.
  * vendor: bump ginkgo, gover
  * portmap plugin should flush previous udp connections
  * Updating plugin README.md files (#549)
  * update netlink dependencies
  * Xdhcp: fix example configuration
  * VRF: extend supported version to 0.3.1 too.
  * VRF CNI: Add an optional table parameter.
  * Add more tests for the vrf cni plugin.
  * Update github.com/vishvananda/netlink to v1.1.0
  * Introduce a new VRF CNI meta plugin.
  * Travis: run tests on arm64
  * Replace nc with the local echo client.
  * Add an echo client to be used instead of nc.
  * Bump up the ubuntu version used in CI to bionic.
  * flannel: allow input ipam parameters as basis for delegate
  * ipvlan: make master config as optional
  * Remove extraneous test file in Windows plugin</changelog>
  <changelog author="rpm@fthiessen.de" date="1619438400">- Update to version 0.9.1:
  * ipam/dhcp: Add broadcast flag
  * add flannel to support dual stack ip
  * bandwidth: fix panic in tests
  * host-device: Add support for DPDK device
  * [main/vlan] Fix error handling for delegate IPAM plugin
  * dhcp: default dhcp clien timeout is 10s
  * vlan: fix error message text by removing ptp references
  * dhcp: daemon dhcp client timeout is configurable
  * dhcp: timeout value is set in DHCP daemon
  * remove unused function
  * deps: go mod tidy coreos/go-iptables
  * deps: bump coreos/go-iptables</changelog>
  <changelog author="fvogt@suse.com" date="1648555200">- Update to version 1.1.1:
  * ipam/dhcp: Fix client id in renew/release
  * call ipam.ExceDel after clean up device in netns fix #666
  * portmap: fix checkPorts result when chain does not exist
  * portmap: fix bug that new udp connection deletes all existing conntrack entries
  * Enhanced dad set to 1
  * Add boolean to enable/disable dad
  * Disable DAD for container side veth
  * firewall: support ingressPolicy=(open|same-bridge) for isolating bridges as in Docker
  * Fix host-device gofmt
  * host-device: Bring interfaces up after moving into container
  * pkg/ns: use file system magic numbers from golang.org/x/sys/unix
  * gofmt
  * go mod tidy
  * build: bump to go 1.17
  * Remove arp notify setting per comment
  * plugins: replace arping package with arp_notify
  * fix #685
  * Ran go fmt so tests would pass
  * Fixed DHCP problem that broke when fast retry was added.
  * dhcp ipam: adjust retry mechanism
  * add ipam tests for dpdk device
  * add ipam support for dpdk device
  * ipvlan: Send Gratuitous ARP after IPs are set
  * dhcp ipam: fix client id
  * dhcp ipam: rename inconsistent options among files
  * dhcp ipam: add more options capable for sending
  * dhcp ipam: add fast retry
  * dhcp ipam: support customizing dhcp options
  * dhcp ipam: truncate client id to 254 bytes
  * dhcp ipam: print error correctly without format string
  * dhcp ipam: using full config to regular the code
  * Allow setting sysctls on a particular interface
  * dhcp: remove implemented TODO
  * Don't redundantly filepath.Clean the output of filepath.Join
  * Use crypto/rand.Read, not crypto.Reader.Read
  * bridge: Add macspoofchk support
  * plugins: fix bug where support for CNI version 0.4.0 or 1.0.0 was dropped
  * vendor: bump to libcni v1.0.1
  * static ipam: do not parse the CIDR twice
  * static ipam: improve error msgs when provisioning invalid CIDR
  * bump go to 1.16, other misc fixes
  * vendor: bump all direct dependencies
  * vendor: bump to libcni v1.0
  * docs: Update the CI badge from Travis CI to GitHub Actions
  * bridge: Fix typo in error message for promiscuous mode
  * ip: place veth peer in host namspace directly
  * bridge: Add mac field to specify container iface mac
  * static ipam: decide wrong cidr error msg
  * static ipam: stop wrapping net.ParseCIDR errors
  * static ipam: show confusing error msg
  * utils, hwaddr: Remove unused package
  * ip, link_linux: Remove unused SetHWAddrByIP function
  * plugins: remove flannel
  * refactor(win-bridge): netconf
  * refactor(win-bridge): hcn api processing
  * refactor(win-bridge): hns api processing
  * chore(win-bridge): location related
  * chore(win-bridge): text related
  * Remove Bryan Boreham as maintainer
  * host-local: support ip/prefix in env args and CNI args
  * [sbr]: Use different tableID for every ipCfg        Check tableID not in use for every ipCfg
  * Small typo improves in README.md
  * Allow multiple routes to be added for the same prefix. Enables ECMP
  * Update to lastest vendor/github.com/vishvananda/netlink
  * tuning: always update MAC in CNI result
  * vendor: bump to libcni v1.0-rc1
  * tuning: Add support of altering the allmulticast flag
  * [sbr]: Use different tableID for every ipCfg        Move default table routes which  match the ipCfg config
  * Fix nil-pointer check
  * host-local: support custom IPs allocation through runtime configuration
  * pkg/ip: introduce a new type `IP` to support formated &lt;ip&gt;[/&lt;prefix&gt;]
  * go.mod: github.com/j-keck/arping v1.0.1
  * go.mod: github.com/buger/jsonparser v1.1.1
  * go.mod: github.com/alexflint/go-filemutex v1.1.0
  * go.mod github.com/Microsoft/hcsshim v0.8.16
  * go.mod: godbus/dbus/v5 v5.0.3, coreos/go-systemd v22.2.0
  * go.mod: github.com/mattn/go-shellwords v1.0.11
  * go.mod: github.com/sirupsen/logrus v1.8.1
  * CI: Install linux-modules-extra for VRF module
  * Fix broken links to online docs in plugin READMEs
  * gha: update actions/setup-go@v2
  * remove redundant startRange in RangeIter due to overlap check on multi ranges
  * fix(win-bridge): panic while calling HNS api
  * portmap: use slashes in sysctl template to support interface names which separated by dots
  * pkg/ipam: use slash as sysctl separator so interface name can have dot
  * [macvlan] Stop setting proxy-arp on macvlan interface
  * tuning: increase test coverage to 1.0.0 and older spec versions
  * portmap: increase test coverage to 1.0.0 and older spec versions
  * flannel: increase test coverage to 1.0.0 and older spec versions
  * firewall: increase test coverage to 1.0.0 and older spec versions
  * bandwidth: increase test coverage to 1.0.0 and older spec versions
  * host-local: increase test coverage to 1.0.0 and older spec versions
  * static: increase test coverage to 1.0.0 and older spec versions
  * dhcp: increase test coverage to 1.0.0 and older spec versions
  * dhcp: add -resendmax option to limit lease acquisition time for testcases
  * vlan: increase test coverage to 1.0.0 and older spec versions
  * ptp: increase test coverage to 1.0.0 and older spec versions
  * macvlan: increase test coverage to 1.0.0 and older spec versions
  * loopback: increase test coverage to 1.0.0 and older spec versions
  * ipvlan: increase test coverage to 1.0.0 and older spec versions
  * host-device: increase test coverage to 1.0.0 and older spec versions
  * bridge: increase test coverage to 1.0.0 and older spec versions
  * bridge: simplify version-based testcase code
  * testutils: add test utilities for spec version features
  * plugins: update to spec version 1.0.0
  * vendor: bump CNI to 1.0.0-pre @ 62e54113 (fixes bsc#1181961 aka CVE-2021-20206)
- Drop %go_nostrip</changelog>
</package>
<package pkgid="362af06b56866a41b96f9b5df68bce976fddc2c8303301f60eb5d550e00e1acf" name="cni-plugins" arch="x86_64">
  <version epoch="0" ver="1.1.1" rel="150500.3.2.1"/>
  <changelog author="alvaro.saurin@suse.com" date="1503921600">- Initial version from CNI plugins v0.6.0</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1503921601">- Install docs in the cni-plugins dir</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1513684800">- Require cni</changelog>
  <changelog author="dcassany@suse.com" date="1528113600">- Make use of %license macro</changelog>
  <changelog author="dcassany@suse.com" date="1528200000">- Refactor %license usage to a simpler form</changelog>
  <changelog author="alvaro.saurin@suse.com" date="1544616000">- Updated to a supported version of Go (due to security reasons)</changelog>
  <changelog author="sgrunert@suse.com" date="1548417600">- Updated plugins to v0.7.4:
  - Add host-device plugin, which simply moves a device from the
    host network namespace
  - Portmap now uses a more efficient rule structure
  - host-local can receive ranges as a RuntimeArgument
  - DHCP daemon can be containerized
  - DHCP now correctly parses routes
  - Various Windows build fixes
  - Waiting for DAD is skipped when possible
  - Bridge now uses a stable mac
  - Fix a regression where the interface's MAC address was no
    longer populated in the return type.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1558353600">- Updated plugins to v0.8.0:
  + New plugins:
  * bandwidth - limit incoming and outgoing bandwidth
  * firewall - add containers to firewall rules
  * sbr - convert container routes to source-based routes
  * static - assign a fixed IP address
  * win-bridge, win-overlay: Windows plugins
  + Plugin features / changelog:
  * CHECK Support
  * macvlan:
  - Allow to configure empty ipam for macvlan
  - Make master config optional
  * bridge:
  - Add vlan tag to the bridge cni plugin
  - Allow the user to assign VLAN tag
  - L2 bridge Implementation.
  * dhcp:
  - Include Subnet Mask option parameter in DHCPREQUEST
  - Add systemd unit file to activate socket with systemd
  - Add container ifName to the dhcp clientID, making the
    clientID value
  * flannel:
  - Pass through runtimeConfig to delegate
  * host-local:
  - host-local: add ifname to file tracking IP address used
  * host-device:
  - Support the IPAM in the host-device
  - Handle empty netns in DEL for loopback and host-device
  * tuning:
  - adds 'ip link' command related feature into tuning
  + Bug fixes &amp; minor changes
  * Correctly DEL on ipam failure for all plugins
  * Fix bug on ip revert if cmdAdd fails on macvlan and host-device
  * host-device: Ensure device is down before rename
  * Fix -hostprefix option
  * some DHCP servers expect to request for explicit router options
  * bridge: release IP in case of error
  * change source of ipmasq rule from ipn to ip
  + Build fixes:
  * test: add coveralls support
  * plugins: correctly output build version, cosmetic cleanups
  * Move Windows tests to Travis
- from version v0.7.5:
  + This release takes a minor change to the portmap plugin:
  * Portmap: append, rather than prepend, entry rules
  + This fixes a potential issue where firewall rules may
    be bypassed by port mapping
- Include patch to fix the build on i586:
  + 0001_use_Go_facilities_to_get_a_socket.patch
- Use new build_linux.sh script instead of removed build.sh</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1559822400">- Updated plugins to v0.8.1:
  + Bugs:
  * bridge: fix ipMasq setup to use correct source address
  * fix compilation error on 386
  * bandwidth: get bandwidth interface in host ns through
    container interface
  + Improvements:
  * Release: bump go to v1.12
  * host-device: add pciBusID property
- Drop patches merged upstream:
  + 0001_use_Go_facilities_to_get_a_socket.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1565956800">- Update plugins to v0.8.2
  + New features:
  * Support "args" in static and tuning
  * Add Loopback DSR support, allow l2tunnel networks
    to be used with the l2bridge plugin
  * host-local: return error if same ADD request is seen twice
  * bandwidth: fix collisions
  * Support ips capability in static and mac capability in tuning
  * pkg/veth: Make host-side veth name configurable
  + Bug fixes:
  * Fix: failed to set bridge addr: could not add IP address to "cni0": file exists
  * host-device: revert name setting to make retries idempotent (#357).
  * Vendor update go-iptables. Vendor update go-iptables to
    obtain commit f1d0510cabcb710d5c5dd284096f81444b9d8d10
  * Update go.mod &amp; go.sub
  * Remove link Down/Up in MAC address change to prevent route flush (#364).
  * pkg/ip unit test: be agnostic of Linux version, on Linux 4.4 the syscall
    error message is "invalid argument" not "file exists"
  * bump containernetworking/cni to v0.7.1</changelog>
  <changelog author="sgrunert@suse.com" date="1573473600">- Update to version 0.8.3:
  * Enhancements:
  * static: prioritize the input sources for IPs (#400).
  * tuning: send gratuitous ARP in case of MAC address update (#403).
  * bandwidth: use uint64 for Bandwidth value (#389).
  * ptp: only override DNS conf if DNS settings provided (#388).
  * loopback: When prevResults are not supplied to loopback plugin, create results to return (#383).
  * loopback support CNI CHECK and result cache (#374).
  * Better input validation:
  * vlan: add MTU validation to loadNetConf (#405).
  * macvlan: add MTU validation to loadNetConf (#404).
  * bridge: check vlan id when loading net conf (#394).
  * Bugfixes:
  * bugfix: defer after err check, or it may panic (#391).
  * portmap: Fix dual-stack support (#379).
  * firewall: don't return error in DEL if prevResult is not found (#390).
  * bump up libcni back to v0.7.1 (#377).
  * Tests:
  * integration: fix ip address collision in integration tests (#409).
  * testutils: newNS() works in a rootless user namespace (#401).
  * Bump Go version (#386).
  * Cleanup netns after test suite (#375).
  * Docs:
  * contributing doc: revise test script name to run (#396).
  * contributing doc: describe cnitool installation (#397).</changelog>
  <changelog author="sgrunert@suse.com" date="1578571200">- Update to version 0.8.4 (bsc#1160460):
  * add support for mips64le
  * Add missing cniVersion in README example
  * bump go-iptables module to v0.4.5
  * iptables: add idempotent functions
  * portmap doesn't fail if chain doesn't exist
  * fix portmap port forward flakiness
  * Add Bruce Ma and Piotr Skarmuk as owners</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- Update to version 0.8.6 (bsc#1172410 CVE-2020-10749)
  * New features
  * Support device id in host device plugin (#471).
  * win-bridge: add support for portMappings capability (#475).
  * Make host-device to work with virtio net device (#453).
  * Small improvements
  * ptp, bridge: disable accept_ra on the host-side interface (#484).
  * modify the error url of windowscontainer (#460).
  * portmap: Apply the DNAT hairpin to the whole subnet (#469). The DNAT hairpin
    rule only allow the * container itself to access the ports it is exposing thru
    the host IP. Other containers in the same subnet might also want to access this
    service via the host IP, so apply this rule to the whole subnet instead of just
    for the container.
  * Unlock OS thread after netns is restored (#455).
  * Bugfixes
  * plugins/meta/sbr: Adjusted ipv6 address mask to /128 (#479). A /64 mask was used
    which routed an entire cidr based on source, not only the bound address.
  * check bridge's port state (#468). fix #463
  * Reset the route flag before moving the rule (#472).
  * replace juju/errors because of CNCF license scan (#458). ref to #457
  * loopback: Fix ipv6 address checks (#442). Fixes a minor bug in loopback plugin.
    The IPv6 address check loops over IPv4 addresses.
- from version 0.8.5
  * Bugfixes
  * bridge: Fix for the case where kernel doesn't have CONFIG_BRIDGE_VLAN_FILTERING
    (#434) fixes #370.
  * vlan: Fix vlan plugin returning error when device is already removed (#438).
  * Improvements
  * sysctl: Improve support of sysctl name separators (#437).</changelog>
  <changelog author="dmueller@suse.com" date="1598875200">- Update to version 0.8.7:
  * Fix race condition in GetCurrentNS
  * lo: CNI_IFNAME is no longer ignored
  * cni: bump to 0.8.0
  * Bump Go version to 1.13 and 1.14
  * Add contact info
  * Update firewall README.md CNI-ADMIN
  * firewall: fix some typos in docs
  * portmap DEL noop if no portMappings present
  * flannel: remove net conf file after DEL succeed</changelog>
  <changelog author="rbrown@suse.com" date="1610107200">- Update to version 0.9.0:
  * tuning: revert values on delete (#540)
  * go mod tidy
  * bump to go 1.15
  * Add ability to trigger retests via comments
  * pkg/ns: fix test case to tolerate pids going away.
  * Add github build &amp; test actions
  * bridge: fix testcase to check addresses we care about
  * Remove travis.
  * vendor: bump ginkgo, gover
  * portmap plugin should flush previous udp connections
  * Updating plugin README.md files (#549)
  * update netlink dependencies
  * Xdhcp: fix example configuration
  * VRF: extend supported version to 0.3.1 too.
  * VRF CNI: Add an optional table parameter.
  * Add more tests for the vrf cni plugin.
  * Update github.com/vishvananda/netlink to v1.1.0
  * Introduce a new VRF CNI meta plugin.
  * Travis: run tests on arm64
  * Replace nc with the local echo client.
  * Add an echo client to be used instead of nc.
  * Bump up the ubuntu version used in CI to bionic.
  * flannel: allow input ipam parameters as basis for delegate
  * ipvlan: make master config as optional
  * Remove extraneous test file in Windows plugin</changelog>
  <changelog author="rpm@fthiessen.de" date="1619438400">- Update to version 0.9.1:
  * ipam/dhcp: Add broadcast flag
  * add flannel to support dual stack ip
  * bandwidth: fix panic in tests
  * host-device: Add support for DPDK device
  * [main/vlan] Fix error handling for delegate IPAM plugin
  * dhcp: default dhcp clien timeout is 10s
  * vlan: fix error message text by removing ptp references
  * dhcp: daemon dhcp client timeout is configurable
  * dhcp: timeout value is set in DHCP daemon
  * remove unused function
  * deps: go mod tidy coreos/go-iptables
  * deps: bump coreos/go-iptables</changelog>
  <changelog author="fvogt@suse.com" date="1648555200">- Update to version 1.1.1:
  * ipam/dhcp: Fix client id in renew/release
  * call ipam.ExceDel after clean up device in netns fix #666
  * portmap: fix checkPorts result when chain does not exist
  * portmap: fix bug that new udp connection deletes all existing conntrack entries
  * Enhanced dad set to 1
  * Add boolean to enable/disable dad
  * Disable DAD for container side veth
  * firewall: support ingressPolicy=(open|same-bridge) for isolating bridges as in Docker
  * Fix host-device gofmt
  * host-device: Bring interfaces up after moving into container
  * pkg/ns: use file system magic numbers from golang.org/x/sys/unix
  * gofmt
  * go mod tidy
  * build: bump to go 1.17
  * Remove arp notify setting per comment
  * plugins: replace arping package with arp_notify
  * fix #685
  * Ran go fmt so tests would pass
  * Fixed DHCP problem that broke when fast retry was added.
  * dhcp ipam: adjust retry mechanism
  * add ipam tests for dpdk device
  * add ipam support for dpdk device
  * ipvlan: Send Gratuitous ARP after IPs are set
  * dhcp ipam: fix client id
  * dhcp ipam: rename inconsistent options among files
  * dhcp ipam: add more options capable for sending
  * dhcp ipam: add fast retry
  * dhcp ipam: support customizing dhcp options
  * dhcp ipam: truncate client id to 254 bytes
  * dhcp ipam: print error correctly without format string
  * dhcp ipam: using full config to regular the code
  * Allow setting sysctls on a particular interface
  * dhcp: remove implemented TODO
  * Don't redundantly filepath.Clean the output of filepath.Join
  * Use crypto/rand.Read, not crypto.Reader.Read
  * bridge: Add macspoofchk support
  * plugins: fix bug where support for CNI version 0.4.0 or 1.0.0 was dropped
  * vendor: bump to libcni v1.0.1
  * static ipam: do not parse the CIDR twice
  * static ipam: improve error msgs when provisioning invalid CIDR
  * bump go to 1.16, other misc fixes
  * vendor: bump all direct dependencies
  * vendor: bump to libcni v1.0
  * docs: Update the CI badge from Travis CI to GitHub Actions
  * bridge: Fix typo in error message for promiscuous mode
  * ip: place veth peer in host namspace directly
  * bridge: Add mac field to specify container iface mac
  * static ipam: decide wrong cidr error msg
  * static ipam: stop wrapping net.ParseCIDR errors
  * static ipam: show confusing error msg
  * utils, hwaddr: Remove unused package
  * ip, link_linux: Remove unused SetHWAddrByIP function
  * plugins: remove flannel
  * refactor(win-bridge): netconf
  * refactor(win-bridge): hcn api processing
  * refactor(win-bridge): hns api processing
  * chore(win-bridge): location related
  * chore(win-bridge): text related
  * Remove Bryan Boreham as maintainer
  * host-local: support ip/prefix in env args and CNI args
  * [sbr]: Use different tableID for every ipCfg        Check tableID not in use for every ipCfg
  * Small typo improves in README.md
  * Allow multiple routes to be added for the same prefix. Enables ECMP
  * Update to lastest vendor/github.com/vishvananda/netlink
  * tuning: always update MAC in CNI result
  * vendor: bump to libcni v1.0-rc1
  * tuning: Add support of altering the allmulticast flag
  * [sbr]: Use different tableID for every ipCfg        Move default table routes which  match the ipCfg config
  * Fix nil-pointer check
  * host-local: support custom IPs allocation through runtime configuration
  * pkg/ip: introduce a new type `IP` to support formated &lt;ip&gt;[/&lt;prefix&gt;]
  * go.mod: github.com/j-keck/arping v1.0.1
  * go.mod: github.com/buger/jsonparser v1.1.1
  * go.mod: github.com/alexflint/go-filemutex v1.1.0
  * go.mod github.com/Microsoft/hcsshim v0.8.16
  * go.mod: godbus/dbus/v5 v5.0.3, coreos/go-systemd v22.2.0
  * go.mod: github.com/mattn/go-shellwords v1.0.11
  * go.mod: github.com/sirupsen/logrus v1.8.1
  * CI: Install linux-modules-extra for VRF module
  * Fix broken links to online docs in plugin READMEs
  * gha: update actions/setup-go@v2
  * remove redundant startRange in RangeIter due to overlap check on multi ranges
  * fix(win-bridge): panic while calling HNS api
  * portmap: use slashes in sysctl template to support interface names which separated by dots
  * pkg/ipam: use slash as sysctl separator so interface name can have dot
  * [macvlan] Stop setting proxy-arp on macvlan interface
  * tuning: increase test coverage to 1.0.0 and older spec versions
  * portmap: increase test coverage to 1.0.0 and older spec versions
  * flannel: increase test coverage to 1.0.0 and older spec versions
  * firewall: increase test coverage to 1.0.0 and older spec versions
  * bandwidth: increase test coverage to 1.0.0 and older spec versions
  * host-local: increase test coverage to 1.0.0 and older spec versions
  * static: increase test coverage to 1.0.0 and older spec versions
  * dhcp: increase test coverage to 1.0.0 and older spec versions
  * dhcp: add -resendmax option to limit lease acquisition time for testcases
  * vlan: increase test coverage to 1.0.0 and older spec versions
  * ptp: increase test coverage to 1.0.0 and older spec versions
  * macvlan: increase test coverage to 1.0.0 and older spec versions
  * loopback: increase test coverage to 1.0.0 and older spec versions
  * ipvlan: increase test coverage to 1.0.0 and older spec versions
  * host-device: increase test coverage to 1.0.0 and older spec versions
  * bridge: increase test coverage to 1.0.0 and older spec versions
  * bridge: simplify version-based testcase code
  * testutils: add test utilities for spec version features
  * plugins: update to spec version 1.0.0
  * vendor: bump CNI to 1.0.0-pre @ 62e54113 (fixes bsc#1181961 aka CVE-2021-20206)
- Drop %go_nostrip</changelog>
</package>
<package pkgid="b1d0a2e65e670e7570f4412c572a5d691c6468975765d4190311a80f5d314f4c" name="conmon" arch="aarch64">
  <version epoch="0" ver="2.1.7" rel="150500.9.6.1"/>
  <changelog author="rhafer@suse.com" date="1584446400">- Update to v2.0.12
  - oom: fix potential race between verification steps</changelog>
  <changelog author="sgrunert@suse.com" date="1585137600">- Update to v2.0.14
  - drop usage of splice(2)
  - avoid hanging on stdin
  - stdio: sometimes quit main loop after io is done
  - ignore sigpipe</changelog>
  <changelog author="sgrunert@suse.com" date="1585915200">- Update to v2.0.15
  - store status while waiting for pid</changelog>
  <changelog author="rhafer@suse.com" date="1585915201">- Enable support for journald logging (bsc#1162432)</changelog>
  <changelog author="sgrunert@suse.com" date="1589803200">- Update to v2.0.16
  - tty: flush pending data when fd is ready</changelog>
  <changelog author="sgrunert@suse.com" date="1590580800">- Update to v2.0.17
  - Add option to delay execution of exit command</changelog>
  <changelog author="sgrunert@suse.com" date="1596024000">- Update to v2.0.20 (bsc#1175821)
  - journald: fix logging container name
  - container logging: Implement none driver - "off", "null" or
    "none" all work.
  - ctrl: warn if we fail to unlink
  - Drop fsync calls
  - Reap PIDs before running exit command
  - Fix log path parsing
  - Add --sync option to prevent conmon from double forking
  - Add --no-sync-log option to instruct conmon to not sync the
    logs of the containers upon shutting down. This feature fixes a
    regression where we unconditionally dropped the log sync. It is
    possible the container logs could be corrupted on a sudden
    power-off. If you need container logs to remain in consistent
    state after a sudden shutdown, please update from v2.0.19 to
    v2.0.20</changelog>
  <changelog author="dmueller@suse.com" date="1600689600">- Update to version 2.0.21:
  * bump to v2.0.21
  * protect against kill(-1)
  * Makefile: enable debuginfo generation
  * Remove go.sum file and add go.mod
  * Fail if conmon config could not be written
  * nix: remove double definition for e2fsprogs
  * Speedup static build by utilizing CI cache on `/nix` folder
  * Fix nix build for failing e2fsprogs tests
  * test: fix CI
  * Use Podman for building</changelog>
  <changelog author="sgrunert@suse.com" date="1610452800">- Update to version 2.0.22:
  * added man page
  * attach: always chdir
  * conn_sock: Explicitly free a heap-allocated string
  * refactor I/O and add SD_NOTIFY proxy support</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1614254400">- Update to version 2.0.26:
  * conn_sock: do not fail on EAGAIN
  * fix segfault from a double freed pointer
  * Fix a bug where conmon could never spawn a container, because
    a disagreement between the caller and itself on where the attach
    socket was.
  * improve --full-attach to ignore the socket-dir directly. that
    means callers don't need to specify a socket dir at all (and
    can remove it)
  * add full-attach option to allow callers to not truncate a very
    long path for the attach socket
  * close only opened FDs
  * set locale to inherit environment</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1617105600">- Update to version 2.0.27:
  * bump to v2.0.27
  * Add CRI-O integration test GitHub action
  * exec: don't fail on EBADFD
  * close_fds: fix close of external fds
  * Add arm64 static build binary
  * bump to v2.0.27-dev</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1627041600">- Update to version 2.0.29:
  * Reset OOM score back to 0 for container runtime
  * call functions registered with atexit on SIGTERM
  * conn_sock: fix potential segfault</changelog>
  <changelog author="info@paolostivanin.com" date="1632484800">- Update to version 2.0.30:
  * Remove unreachable code path
  * exit: report if the exit command was killed
  * exit: fix race zombie reaper
  * conn_sock: allow watchdog messages through the notify socket proxy
  * seccomp: add support for seccomp notify</changelog>
  <changelog author="rpm@fthiessen.de" date="1651752000">- Update to version 2.1.0
  * logging: buffer partial messages to journald
  * exit: close all fds &gt;= 3
  * fix: cgroup: Free memory_cgroup_file_path if open fails.
    Call g_free instead of free.
- Update to version 2.0.32
  * Fix: Avoid mainfd_std{in,out} sharing the same file descriptor.
  * exit_command: Fix: unset subreaper attribute before running exit command
- Update to version 2.0.31
  * logging: new mode -l passthrough
  * ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald
  * conmon: Fix: free userdata files before exec cleanup</changelog>
  <changelog author="idesmi@protonmail.com" date="1656504000">- Update to version 2.1.2:
  * add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 boo#1200285)
  * journald: print tag and name if both are specified
  * drop some logs to debug level</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- update to 2.1.3:
  * Port conmon to FreeBSD
  * Stop using g_unix_signal_add() to avoid threads
  * Rename CLI optionlog-size-global-max to log-global-size-max</changelog>
  <changelog author="fvogt@suse.com" date="1667563200">- Add patch to fix build with make &gt;= 4.4:
  * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch</changelog>
  <changelog author="dcermak@suse.com" date="1669204800">- Update to version 2.1.5:
  * don't leak syslog_identifier
  * logging: do not read more that the buf size
  * logging: fix error handling
  * Makefile: Fix install for FreeBSD
  * signal: Track changes to get_signal_descriptor in the FreeBSD version
  * Packit: initial enablement
- Update to version 2.1.4:
  * Fix a bug where conmon crashed when it got a SIGCHLD</changelog>
  <changelog author="dcermak@suse.com" date="1678881600">- New upstream release 2.1.7
  2.1.7:
  [#]## Bug Fixes
  Fix leaking symbolic links in the opt_socket_path directory
  cgroup: Stumble on if we can't set up oom handling (bsc#1208737)
  2.1.6:
  [#]## Bug Fixes
  * Fix OOM watcher for cgroupv2 `oom_kill` events
  [#]## Misc
  * Use --detach instead of -d
  * ctrl: drop fifo perms to 0660
- Remove merged patch:
  * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch
- Bump go version to 1.19 (bsc#1209307)</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1695988800">- go 1.19 EOL, swith to go &gt;= 1.20
  * [bsc#1215806]</changelog>
</package>
<package pkgid="e4904bfec1ccc1e418a87353eafd4b557cd9f3dd1594bddf8674cada86adec2a" name="conmon" arch="s390x">
  <version epoch="0" ver="2.1.7" rel="150500.9.6.1"/>
  <changelog author="rhafer@suse.com" date="1584446400">- Update to v2.0.12
  - oom: fix potential race between verification steps</changelog>
  <changelog author="sgrunert@suse.com" date="1585137600">- Update to v2.0.14
  - drop usage of splice(2)
  - avoid hanging on stdin
  - stdio: sometimes quit main loop after io is done
  - ignore sigpipe</changelog>
  <changelog author="sgrunert@suse.com" date="1585915200">- Update to v2.0.15
  - store status while waiting for pid</changelog>
  <changelog author="rhafer@suse.com" date="1585915201">- Enable support for journald logging (bsc#1162432)</changelog>
  <changelog author="sgrunert@suse.com" date="1589803200">- Update to v2.0.16
  - tty: flush pending data when fd is ready</changelog>
  <changelog author="sgrunert@suse.com" date="1590580800">- Update to v2.0.17
  - Add option to delay execution of exit command</changelog>
  <changelog author="sgrunert@suse.com" date="1596024000">- Update to v2.0.20 (bsc#1175821)
  - journald: fix logging container name
  - container logging: Implement none driver - "off", "null" or
    "none" all work.
  - ctrl: warn if we fail to unlink
  - Drop fsync calls
  - Reap PIDs before running exit command
  - Fix log path parsing
  - Add --sync option to prevent conmon from double forking
  - Add --no-sync-log option to instruct conmon to not sync the
    logs of the containers upon shutting down. This feature fixes a
    regression where we unconditionally dropped the log sync. It is
    possible the container logs could be corrupted on a sudden
    power-off. If you need container logs to remain in consistent
    state after a sudden shutdown, please update from v2.0.19 to
    v2.0.20</changelog>
  <changelog author="dmueller@suse.com" date="1600689600">- Update to version 2.0.21:
  * bump to v2.0.21
  * protect against kill(-1)
  * Makefile: enable debuginfo generation
  * Remove go.sum file and add go.mod
  * Fail if conmon config could not be written
  * nix: remove double definition for e2fsprogs
  * Speedup static build by utilizing CI cache on `/nix` folder
  * Fix nix build for failing e2fsprogs tests
  * test: fix CI
  * Use Podman for building</changelog>
  <changelog author="sgrunert@suse.com" date="1610452800">- Update to version 2.0.22:
  * added man page
  * attach: always chdir
  * conn_sock: Explicitly free a heap-allocated string
  * refactor I/O and add SD_NOTIFY proxy support</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1614254400">- Update to version 2.0.26:
  * conn_sock: do not fail on EAGAIN
  * fix segfault from a double freed pointer
  * Fix a bug where conmon could never spawn a container, because
    a disagreement between the caller and itself on where the attach
    socket was.
  * improve --full-attach to ignore the socket-dir directly. that
    means callers don't need to specify a socket dir at all (and
    can remove it)
  * add full-attach option to allow callers to not truncate a very
    long path for the attach socket
  * close only opened FDs
  * set locale to inherit environment</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1617105600">- Update to version 2.0.27:
  * bump to v2.0.27
  * Add CRI-O integration test GitHub action
  * exec: don't fail on EBADFD
  * close_fds: fix close of external fds
  * Add arm64 static build binary
  * bump to v2.0.27-dev</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1627041600">- Update to version 2.0.29:
  * Reset OOM score back to 0 for container runtime
  * call functions registered with atexit on SIGTERM
  * conn_sock: fix potential segfault</changelog>
  <changelog author="info@paolostivanin.com" date="1632484800">- Update to version 2.0.30:
  * Remove unreachable code path
  * exit: report if the exit command was killed
  * exit: fix race zombie reaper
  * conn_sock: allow watchdog messages through the notify socket proxy
  * seccomp: add support for seccomp notify</changelog>
  <changelog author="rpm@fthiessen.de" date="1651752000">- Update to version 2.1.0
  * logging: buffer partial messages to journald
  * exit: close all fds &gt;= 3
  * fix: cgroup: Free memory_cgroup_file_path if open fails.
    Call g_free instead of free.
- Update to version 2.0.32
  * Fix: Avoid mainfd_std{in,out} sharing the same file descriptor.
  * exit_command: Fix: unset subreaper attribute before running exit command
- Update to version 2.0.31
  * logging: new mode -l passthrough
  * ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald
  * conmon: Fix: free userdata files before exec cleanup</changelog>
  <changelog author="idesmi@protonmail.com" date="1656504000">- Update to version 2.1.2:
  * add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 boo#1200285)
  * journald: print tag and name if both are specified
  * drop some logs to debug level</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- update to 2.1.3:
  * Port conmon to FreeBSD
  * Stop using g_unix_signal_add() to avoid threads
  * Rename CLI optionlog-size-global-max to log-global-size-max</changelog>
  <changelog author="fvogt@suse.com" date="1667563200">- Add patch to fix build with make &gt;= 4.4:
  * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch</changelog>
  <changelog author="dcermak@suse.com" date="1669204800">- Update to version 2.1.5:
  * don't leak syslog_identifier
  * logging: do not read more that the buf size
  * logging: fix error handling
  * Makefile: Fix install for FreeBSD
  * signal: Track changes to get_signal_descriptor in the FreeBSD version
  * Packit: initial enablement
- Update to version 2.1.4:
  * Fix a bug where conmon crashed when it got a SIGCHLD</changelog>
  <changelog author="dcermak@suse.com" date="1678881600">- New upstream release 2.1.7
  2.1.7:
  [#]## Bug Fixes
  Fix leaking symbolic links in the opt_socket_path directory
  cgroup: Stumble on if we can't set up oom handling (bsc#1208737)
  2.1.6:
  [#]## Bug Fixes
  * Fix OOM watcher for cgroupv2 `oom_kill` events
  [#]## Misc
  * Use --detach instead of -d
  * ctrl: drop fifo perms to 0660
- Remove merged patch:
  * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch
- Bump go version to 1.19 (bsc#1209307)</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1695988800">- go 1.19 EOL, swith to go &gt;= 1.20
  * [bsc#1215806]</changelog>
</package>
<package pkgid="c75ed0fb0246f249b4561ba1c1eadc0a1f7e4a4fabdcb48bb014201520c31ceb" name="conmon" arch="src">
  <version epoch="0" ver="2.1.7" rel="150500.9.6.1"/>
  <changelog author="rhafer@suse.com" date="1584446400">- Update to v2.0.12
  - oom: fix potential race between verification steps</changelog>
  <changelog author="sgrunert@suse.com" date="1585137600">- Update to v2.0.14
  - drop usage of splice(2)
  - avoid hanging on stdin
  - stdio: sometimes quit main loop after io is done
  - ignore sigpipe</changelog>
  <changelog author="sgrunert@suse.com" date="1585915200">- Update to v2.0.15
  - store status while waiting for pid</changelog>
  <changelog author="rhafer@suse.com" date="1585915201">- Enable support for journald logging (bsc#1162432)</changelog>
  <changelog author="sgrunert@suse.com" date="1589803200">- Update to v2.0.16
  - tty: flush pending data when fd is ready</changelog>
  <changelog author="sgrunert@suse.com" date="1590580800">- Update to v2.0.17
  - Add option to delay execution of exit command</changelog>
  <changelog author="sgrunert@suse.com" date="1596024000">- Update to v2.0.20 (bsc#1175821)
  - journald: fix logging container name
  - container logging: Implement none driver - "off", "null" or
    "none" all work.
  - ctrl: warn if we fail to unlink
  - Drop fsync calls
  - Reap PIDs before running exit command
  - Fix log path parsing
  - Add --sync option to prevent conmon from double forking
  - Add --no-sync-log option to instruct conmon to not sync the
    logs of the containers upon shutting down. This feature fixes a
    regression where we unconditionally dropped the log sync. It is
    possible the container logs could be corrupted on a sudden
    power-off. If you need container logs to remain in consistent
    state after a sudden shutdown, please update from v2.0.19 to
    v2.0.20</changelog>
  <changelog author="dmueller@suse.com" date="1600689600">- Update to version 2.0.21:
  * bump to v2.0.21
  * protect against kill(-1)
  * Makefile: enable debuginfo generation
  * Remove go.sum file and add go.mod
  * Fail if conmon config could not be written
  * nix: remove double definition for e2fsprogs
  * Speedup static build by utilizing CI cache on `/nix` folder
  * Fix nix build for failing e2fsprogs tests
  * test: fix CI
  * Use Podman for building</changelog>
  <changelog author="sgrunert@suse.com" date="1610452800">- Update to version 2.0.22:
  * added man page
  * attach: always chdir
  * conn_sock: Explicitly free a heap-allocated string
  * refactor I/O and add SD_NOTIFY proxy support</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1614254400">- Update to version 2.0.26:
  * conn_sock: do not fail on EAGAIN
  * fix segfault from a double freed pointer
  * Fix a bug where conmon could never spawn a container, because
    a disagreement between the caller and itself on where the attach
    socket was.
  * improve --full-attach to ignore the socket-dir directly. that
    means callers don't need to specify a socket dir at all (and
    can remove it)
  * add full-attach option to allow callers to not truncate a very
    long path for the attach socket
  * close only opened FDs
  * set locale to inherit environment</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1617105600">- Update to version 2.0.27:
  * bump to v2.0.27
  * Add CRI-O integration test GitHub action
  * exec: don't fail on EBADFD
  * close_fds: fix close of external fds
  * Add arm64 static build binary
  * bump to v2.0.27-dev</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1627041600">- Update to version 2.0.29:
  * Reset OOM score back to 0 for container runtime
  * call functions registered with atexit on SIGTERM
  * conn_sock: fix potential segfault</changelog>
  <changelog author="info@paolostivanin.com" date="1632484800">- Update to version 2.0.30:
  * Remove unreachable code path
  * exit: report if the exit command was killed
  * exit: fix race zombie reaper
  * conn_sock: allow watchdog messages through the notify socket proxy
  * seccomp: add support for seccomp notify</changelog>
  <changelog author="rpm@fthiessen.de" date="1651752000">- Update to version 2.1.0
  * logging: buffer partial messages to journald
  * exit: close all fds &gt;= 3
  * fix: cgroup: Free memory_cgroup_file_path if open fails.
    Call g_free instead of free.
- Update to version 2.0.32
  * Fix: Avoid mainfd_std{in,out} sharing the same file descriptor.
  * exit_command: Fix: unset subreaper attribute before running exit command
- Update to version 2.0.31
  * logging: new mode -l passthrough
  * ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald
  * conmon: Fix: free userdata files before exec cleanup</changelog>
  <changelog author="idesmi@protonmail.com" date="1656504000">- Update to version 2.1.2:
  * add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 boo#1200285)
  * journald: print tag and name if both are specified
  * drop some logs to debug level</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- update to 2.1.3:
  * Port conmon to FreeBSD
  * Stop using g_unix_signal_add() to avoid threads
  * Rename CLI optionlog-size-global-max to log-global-size-max</changelog>
  <changelog author="fvogt@suse.com" date="1667563200">- Add patch to fix build with make &gt;= 4.4:
  * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch</changelog>
  <changelog author="dcermak@suse.com" date="1669204800">- Update to version 2.1.5:
  * don't leak syslog_identifier
  * logging: do not read more that the buf size
  * logging: fix error handling
  * Makefile: Fix install for FreeBSD
  * signal: Track changes to get_signal_descriptor in the FreeBSD version
  * Packit: initial enablement
- Update to version 2.1.4:
  * Fix a bug where conmon crashed when it got a SIGCHLD</changelog>
  <changelog author="dcermak@suse.com" date="1678881600">- New upstream release 2.1.7
  2.1.7:
  [#]## Bug Fixes
  Fix leaking symbolic links in the opt_socket_path directory
  cgroup: Stumble on if we can't set up oom handling (bsc#1208737)
  2.1.6:
  [#]## Bug Fixes
  * Fix OOM watcher for cgroupv2 `oom_kill` events
  [#]## Misc
  * Use --detach instead of -d
  * ctrl: drop fifo perms to 0660
- Remove merged patch:
  * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch
- Bump go version to 1.19 (bsc#1209307)</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1695988800">- go 1.19 EOL, swith to go &gt;= 1.20
  * [bsc#1215806]</changelog>
</package>
<package pkgid="107fcc01882b51bc2c6d991bda1ebcc901f6e927be114c648fcfd52d1135733e" name="conmon" arch="x86_64">
  <version epoch="0" ver="2.1.7" rel="150500.9.6.1"/>
  <changelog author="rhafer@suse.com" date="1584446400">- Update to v2.0.12
  - oom: fix potential race between verification steps</changelog>
  <changelog author="sgrunert@suse.com" date="1585137600">- Update to v2.0.14
  - drop usage of splice(2)
  - avoid hanging on stdin
  - stdio: sometimes quit main loop after io is done
  - ignore sigpipe</changelog>
  <changelog author="sgrunert@suse.com" date="1585915200">- Update to v2.0.15
  - store status while waiting for pid</changelog>
  <changelog author="rhafer@suse.com" date="1585915201">- Enable support for journald logging (bsc#1162432)</changelog>
  <changelog author="sgrunert@suse.com" date="1589803200">- Update to v2.0.16
  - tty: flush pending data when fd is ready</changelog>
  <changelog author="sgrunert@suse.com" date="1590580800">- Update to v2.0.17
  - Add option to delay execution of exit command</changelog>
  <changelog author="sgrunert@suse.com" date="1596024000">- Update to v2.0.20 (bsc#1175821)
  - journald: fix logging container name
  - container logging: Implement none driver - "off", "null" or
    "none" all work.
  - ctrl: warn if we fail to unlink
  - Drop fsync calls
  - Reap PIDs before running exit command
  - Fix log path parsing
  - Add --sync option to prevent conmon from double forking
  - Add --no-sync-log option to instruct conmon to not sync the
    logs of the containers upon shutting down. This feature fixes a
    regression where we unconditionally dropped the log sync. It is
    possible the container logs could be corrupted on a sudden
    power-off. If you need container logs to remain in consistent
    state after a sudden shutdown, please update from v2.0.19 to
    v2.0.20</changelog>
  <changelog author="dmueller@suse.com" date="1600689600">- Update to version 2.0.21:
  * bump to v2.0.21
  * protect against kill(-1)
  * Makefile: enable debuginfo generation
  * Remove go.sum file and add go.mod
  * Fail if conmon config could not be written
  * nix: remove double definition for e2fsprogs
  * Speedup static build by utilizing CI cache on `/nix` folder
  * Fix nix build for failing e2fsprogs tests
  * test: fix CI
  * Use Podman for building</changelog>
  <changelog author="sgrunert@suse.com" date="1610452800">- Update to version 2.0.22:
  * added man page
  * attach: always chdir
  * conn_sock: Explicitly free a heap-allocated string
  * refactor I/O and add SD_NOTIFY proxy support</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1614254400">- Update to version 2.0.26:
  * conn_sock: do not fail on EAGAIN
  * fix segfault from a double freed pointer
  * Fix a bug where conmon could never spawn a container, because
    a disagreement between the caller and itself on where the attach
    socket was.
  * improve --full-attach to ignore the socket-dir directly. that
    means callers don't need to specify a socket dir at all (and
    can remove it)
  * add full-attach option to allow callers to not truncate a very
    long path for the attach socket
  * close only opened FDs
  * set locale to inherit environment</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1617105600">- Update to version 2.0.27:
  * bump to v2.0.27
  * Add CRI-O integration test GitHub action
  * exec: don't fail on EBADFD
  * close_fds: fix close of external fds
  * Add arm64 static build binary
  * bump to v2.0.27-dev</changelog>
  <changelog author="alexandre.vicenzi@suse.com" date="1627041600">- Update to version 2.0.29:
  * Reset OOM score back to 0 for container runtime
  * call functions registered with atexit on SIGTERM
  * conn_sock: fix potential segfault</changelog>
  <changelog author="info@paolostivanin.com" date="1632484800">- Update to version 2.0.30:
  * Remove unreachable code path
  * exit: report if the exit command was killed
  * exit: fix race zombie reaper
  * conn_sock: allow watchdog messages through the notify socket proxy
  * seccomp: add support for seccomp notify</changelog>
  <changelog author="rpm@fthiessen.de" date="1651752000">- Update to version 2.1.0
  * logging: buffer partial messages to journald
  * exit: close all fds &gt;= 3
  * fix: cgroup: Free memory_cgroup_file_path if open fails.
    Call g_free instead of free.
- Update to version 2.0.32
  * Fix: Avoid mainfd_std{in,out} sharing the same file descriptor.
  * exit_command: Fix: unset subreaper attribute before running exit command
- Update to version 2.0.31
  * logging: new mode -l passthrough
  * ctr_logs: use container name or ID as SYSLOG_IDENTIFIER for journald
  * conmon: Fix: free userdata files before exec cleanup</changelog>
  <changelog author="idesmi@protonmail.com" date="1656504000">- Update to version 2.1.2:
  * add log-global-size-max option to limit the total output conmon processes (CVE-2022-1708 boo#1200285)
  * journald: print tag and name if both are specified
  * drop some logs to debug level</changelog>
  <changelog author="dmueller@suse.com" date="1660737600">- update to 2.1.3:
  * Port conmon to FreeBSD
  * Stop using g_unix_signal_add() to avoid threads
  * Rename CLI optionlog-size-global-max to log-global-size-max</changelog>
  <changelog author="fvogt@suse.com" date="1667563200">- Add patch to fix build with make &gt;= 4.4:
  * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch</changelog>
  <changelog author="dcermak@suse.com" date="1669204800">- Update to version 2.1.5:
  * don't leak syslog_identifier
  * logging: do not read more that the buf size
  * logging: fix error handling
  * Makefile: Fix install for FreeBSD
  * signal: Track changes to get_signal_descriptor in the FreeBSD version
  * Packit: initial enablement
- Update to version 2.1.4:
  * Fix a bug where conmon crashed when it got a SIGCHLD</changelog>
  <changelog author="dcermak@suse.com" date="1678881600">- New upstream release 2.1.7
  2.1.7:
  [#]## Bug Fixes
  Fix leaking symbolic links in the opt_socket_path directory
  cgroup: Stumble on if we can't set up oom handling (bsc#1208737)
  2.1.6:
  [#]## Bug Fixes
  * Fix OOM watcher for cgroupv2 `oom_kill` events
  [#]## Misc
  * Use --detach instead of -d
  * ctrl: drop fifo perms to 0660
- Remove merged patch:
  * 0001-Fix-tools-Makefile-with-GNU-make-4.4.patch
- Bump go version to 1.19 (bsc#1209307)</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1695988800">- go 1.19 EOL, swith to go &gt;= 1.20
  * [bsc#1215806]</changelog>
</package>
<package pkgid="5cb10dc3a213814033157f1d7bdbc9b116e394263960fb46f6f4e46a88b83727" name="containerd" arch="aarch64">
  <version epoch="0" ver="1.6.21" rel="150000.95.1"/>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1633521601">- Update to containerd v1.4.11, to fix CVE-2021-41103. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1637323200">- Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814
  bsc#1193273 CVE-2021-41190</changelog>
  <changelog author="asarai@suse.com" date="1646222400">[ This patch was only released in SLES and Leap. ]
- Add patch for CVE-2022-23648. bsc#1196441
  + CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1646308800">- Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441
- Remove upstreamed patch:
  - CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517</changelog>
  <changelog author="asarai@suse.com" date="1654516800">- Update to containerd v1.5.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.5.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1654516801">[ This patch was only released in SLES and Leap. ]
- Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145
  + bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements
  of Docker v20.10.17-ce. bsc#1200145
- Remove upstreamed patches:
  - bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
</package>
<package pkgid="b4f43097ef410ee2472268c24968541bbb92248d808ee39263f1ef4702b95394" name="containerd" arch="s390x">
  <version epoch="0" ver="1.6.21" rel="150000.95.1"/>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1633521601">- Update to containerd v1.4.11, to fix CVE-2021-41103. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1637323200">- Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814
  bsc#1193273 CVE-2021-41190</changelog>
  <changelog author="asarai@suse.com" date="1646222400">[ This patch was only released in SLES and Leap. ]
- Add patch for CVE-2022-23648. bsc#1196441
  + CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1646308800">- Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441
- Remove upstreamed patch:
  - CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517</changelog>
  <changelog author="asarai@suse.com" date="1654516800">- Update to containerd v1.5.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.5.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1654516801">[ This patch was only released in SLES and Leap. ]
- Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145
  + bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements
  of Docker v20.10.17-ce. bsc#1200145
- Remove upstreamed patches:
  - bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
</package>
<package pkgid="d10f7882fabfaa38f2a6c5df86010654ee63a1df05695d6a5ac43a8185259b1e" name="containerd" arch="src">
  <version epoch="0" ver="1.6.21" rel="150000.95.1"/>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1633521601">- Update to containerd v1.4.11, to fix CVE-2021-41103. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1637323200">- Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814
  bsc#1193273 CVE-2021-41190</changelog>
  <changelog author="asarai@suse.com" date="1646222400">[ This patch was only released in SLES and Leap. ]
- Add patch for CVE-2022-23648. bsc#1196441
  + CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1646308800">- Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441
- Remove upstreamed patch:
  - CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517</changelog>
  <changelog author="asarai@suse.com" date="1654516800">- Update to containerd v1.5.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.5.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1654516801">[ This patch was only released in SLES and Leap. ]
- Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145
  + bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements
  of Docker v20.10.17-ce. bsc#1200145
- Remove upstreamed patches:
  - bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
</package>
<package pkgid="b158ed1e4273459c38b77f51bdd534c5b59012a21efe9dccf0dd9f7689eea138" name="containerd" arch="x86_64">
  <version epoch="0" ver="1.6.21" rel="150000.95.1"/>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1633521601">- Update to containerd v1.4.11, to fix CVE-2021-41103. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
  <changelog author="asarai@suse.com" date="1637323200">- Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814
  bsc#1193273 CVE-2021-41190</changelog>
  <changelog author="asarai@suse.com" date="1646222400">[ This patch was only released in SLES and Leap. ]
- Add patch for CVE-2022-23648. bsc#1196441
  + CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1646308800">- Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441
- Remove upstreamed patch:
  - CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517</changelog>
  <changelog author="asarai@suse.com" date="1654516800">- Update to containerd v1.5.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.5.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1654516801">[ This patch was only released in SLES and Leap. ]
- Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145
  + bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements
  of Docker v20.10.17-ce. bsc#1200145
- Remove upstreamed patches:
  - bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
</package>
<package pkgid="a1634c9ae58c9d6c557eb6533db28f986b7b08674a2def7437eb2bb274ebe241" name="containerd" arch="aarch64">
  <version epoch="0" ver="1.7.7" rel="150000.100.1"/>
  <changelog author="asarai@suse.com" date="1637323200">- Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814
  bsc#1193273 CVE-2021-41190</changelog>
  <changelog author="asarai@suse.com" date="1646222400">[ This patch was only released in SLES and Leap. ]
- Add patch for CVE-2022-23648. bsc#1196441
  + CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1646308800">- Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441
- Remove upstreamed patch:
  - CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517</changelog>
  <changelog author="asarai@suse.com" date="1654516800">- Update to containerd v1.5.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.5.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1654516801">[ This patch was only released in SLES and Leap. ]
- Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145
  + bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements
  of Docker v20.10.17-ce. bsc#1200145
- Remove upstreamed patches:
  - bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
</package>
<package pkgid="270a056cc5ed1e9b34ef96d31619c98ff18bfe1c6dbcde4f315d95310afee263" name="containerd" arch="s390x">
  <version epoch="0" ver="1.7.7" rel="150000.100.1"/>
  <changelog author="asarai@suse.com" date="1637323200">- Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814
  bsc#1193273 CVE-2021-41190</changelog>
  <changelog author="asarai@suse.com" date="1646222400">[ This patch was only released in SLES and Leap. ]
- Add patch for CVE-2022-23648. bsc#1196441
  + CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1646308800">- Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441
- Remove upstreamed patch:
  - CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517</changelog>
  <changelog author="asarai@suse.com" date="1654516800">- Update to containerd v1.5.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.5.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1654516801">[ This patch was only released in SLES and Leap. ]
- Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145
  + bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements
  of Docker v20.10.17-ce. bsc#1200145
- Remove upstreamed patches:
  - bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
</package>
<package pkgid="99af1341d77b8711d5f27b9133227fdea7eeae719ac1890c8a36680a1e23e31a" name="containerd" arch="src">
  <version epoch="0" ver="1.7.7" rel="150000.100.1"/>
  <changelog author="asarai@suse.com" date="1637323200">- Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814
  bsc#1193273 CVE-2021-41190</changelog>
  <changelog author="asarai@suse.com" date="1646222400">[ This patch was only released in SLES and Leap. ]
- Add patch for CVE-2022-23648. bsc#1196441
  + CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1646308800">- Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441
- Remove upstreamed patch:
  - CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517</changelog>
  <changelog author="asarai@suse.com" date="1654516800">- Update to containerd v1.5.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.5.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1654516801">[ This patch was only released in SLES and Leap. ]
- Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145
  + bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements
  of Docker v20.10.17-ce. bsc#1200145
- Remove upstreamed patches:
  - bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
</package>
<package pkgid="9c640d5e50b38122f4013c48266339b1e7266cda832f70c4c4b737129af981d0" name="containerd" arch="x86_64">
  <version epoch="0" ver="1.7.7" rel="150000.100.1"/>
  <changelog author="asarai@suse.com" date="1637323200">- Update to containerd v1.4.12 for Docker 20.10.11-ce. bsc#1192814
  bsc#1193273 CVE-2021-41190</changelog>
  <changelog author="asarai@suse.com" date="1646222400">[ This patch was only released in SLES and Leap. ]
- Add patch for CVE-2022-23648. bsc#1196441
  + CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1646308800">- Update to containerd v1.4.13 to fix CVE-2022-23648. bsc#1196441
- Remove upstreamed patch:
  - CVE-2022-23648.patch</changelog>
  <changelog author="asarai@suse.com" date="1649937600">- Update to containerd v1.5.11 to fix CVE-2022-24769. bsc#1197517</changelog>
  <changelog author="asarai@suse.com" date="1654516800">- Update to containerd v1.5.12. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.5.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1654516801">[ This patch was only released in SLES and Leap. ]
- Backport patch to fix GHSA-5ffw-gxpp-mxpf CVE-2022-31030. bsc#1200145
  + bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="asarai@suse.com" date="1654603200">- Update to containerd v1.6.6 to fix CVE-2022-31030 and meet the requirements
  of Docker v20.10.17-ce. bsc#1200145
- Remove upstreamed patches:
  - bsc1200145-Limit-the-response-size-of-ExecSync.patch</changelog>
  <changelog author="dmueller@suse.com" date="1669723200">- add devel subpackage, which is needed by open-vm-tools</changelog>
  <changelog author="asarai@suse.com" date="1670328000">- Update to containerd v1.6.9 for Docker v20.10.21-ce. Also includes a fix for
  CVE-2022-27191. boo#1206065 bsc#1197284 Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.9&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670328001">- Update to containerd v1.6.11. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.11&gt;</changelog>
  <changelog author="asarai@suse.com" date="1670500800">- Update to containerd v1.6.12 to fix CVE-2022-23471 bsc#1206235. Upstream
  release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.12&gt;</changelog>
  <changelog author="asarai@suse.com" date="1675944000">- Update to containerd v1.6.16 for Docker v23.0.1-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.16&gt;</changelog>
  <changelog author="asarai@suse.com" date="1677672000">- Re-build containerd to use updated golang-packaging. jsc#1342</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to containerd v1.6.19 for Docker v23.0.2-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.19&gt;
  Includes fixes for:
  - CVE-2023-25153 bsc#1208423
  - CVE-2023-25173 bsc#1208426</changelog>
  <changelog author="asarai@suse.com" date="1681819200">- Update to containerd v1.6.20 for Docker v23.0.4-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.20&gt;</changelog>
  <changelog author="meissner@suse.com" date="1683201600">[ This was only released in SLE. ]
- unversion to golang requires to always use the current default go.
  (bsc#1210298)</changelog>
  <changelog author="asarai@suse.com" date="1684670400">- Update to containerd v1.6.21 for Docker v23.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.6.21&gt; bsc#1211578
- Require a minimum Go version explicitly rather than using golang(API).
  Fixes the change for bsc#1210298.</changelog>
  <changelog author="priyanka.saggu@suse.com" date="1693483200">- Add `Provides: cri-runtime` to use containerd as container runtime in Factory
  Kubernetes packages</changelog>
  <changelog author="asarai@suse.com" date="1694692800">- Update to containerd v1.7.6 for Docker v24.0.6-ce. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.6&gt; bsc#1215323</changelog>
  <changelog author="asarai@suse.com" date="1697198400">- Update to containerd v1.7.7. Upstream release notes:
  &lt;https://github.com/containerd/containerd/releases/tag/v1.7.7&gt;
- Add patch to fix build on SLE-12:
  + 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch</changelog>
</package>
<package pkgid="fc1f59d188ef4825e1ad0e971a9024f66d99907987c8e9c0766241173e19b1a2" name="containerized-data-importer" arch="src">
  <version epoch="0" ver="1.57.0" rel="150500.6.3.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1621512000">- Disable changelog generation via tar_scm service (too verbose)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1621512001">- Update to version 1.34.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.34.0</changelog>
  <changelog author="fvogt@suse.com" date="1622808000">- Add REGISTRY variable</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1623672000">- Use registry.suse.com as the default fallback for sle
- Rename macro registry_path to kubevirt_registry_path
- Update to version 1.35.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.35.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1625054400">- Generate meta info for containers during rpm build</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1626091200">- Update to version 1.36.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1692187200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0
- Add registry path for SLE15 SP6</changelog>
</package>
<package pkgid="690db399955b5dbd23e44f98b54679d4c9a207ad161ebf1f2e90b580ab4145c2" name="containerized-data-importer-manifests" arch="x86_64">
  <version epoch="0" ver="1.57.0" rel="150500.6.3.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1621512000">- Disable changelog generation via tar_scm service (too verbose)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1621512001">- Update to version 1.34.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.34.0</changelog>
  <changelog author="fvogt@suse.com" date="1622808000">- Add REGISTRY variable</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1623672000">- Use registry.suse.com as the default fallback for sle
- Rename macro registry_path to kubevirt_registry_path
- Update to version 1.35.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.35.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1625054400">- Generate meta info for containers during rpm build</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1626091200">- Update to version 1.36.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.36.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1628596800">- Update to version 1.37.1
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.37.1</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1633953600">- Update to version 1.40.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.40.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1636718400">- Update to version 1.41.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.41.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1637928000">- Detect SLE15 SP4 build environment</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1639915200">- Update to version 1.42.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.42.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1641816000">- Update to version 1.43.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.43.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1650974400">- Increase storage requirements in _constraints (bsc#1198791)</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Pack only cdi-operator and cdi-cr release manifests</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Update to version 1.51.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.51.0
- Fix CVE-2022-1996 go-restful: CORS bypass (bsc#1200528)
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 1.55.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.55.0
- Drop upstreamed patches:
  0001-Update-go-restful-to-2.16.0.patch
- Include additional tools used by cdi-importer:
  cdi-containerimage-server
  cdi-image-size-detection
  cdi-source-update-poller
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665835200">- Build tools/cdi-containerimage-server with CGO_ENABLED=0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1679659200">- Use recent golang compiler (bsc#1208916)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1692187200">- Update to version 1.57.0
  Release notes https://github.com/kubevirt/containerized-data-importer/releases/tag/v1.57.0
- Add registry path for SLE15 SP6</changelog>
</package>
<package pkgid="3a547a754e29219f29a84072f4afb1507e9f4dd4789d411438b6218d80a5c955" name="cups" arch="src">
  <version epoch="0" ver="2.2.7" rel="150000.3.51.2"/>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
</package>
<package pkgid="2f2351e2c88043e0d16bb3e227dae76b82d48770dcc338f1784edc474b3f6200" name="cups-config" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.51.2"/>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
</package>
<package pkgid="67307e20b3f5af69f9446de0b9582233f35146d5b5cb4187a24fa5fb90fdc1a6" name="cups-config" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.51.2"/>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
</package>
<package pkgid="15b14dc9059560ea9fcae0755ddabd1ce0e0654e3540db3bfc1ea7cbf3aac4bf" name="cups-config" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.51.2"/>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
</package>
<package pkgid="c481adeab307e2c0b9174d35ca0aa97575f67424a81b05479a676f02c53d929e" name="curl" arch="aarch64">
  <version epoch="0" ver="8.0.1" rel="150400.5.32.1"/>
  <changelog author="pmonreal@suse.com" date="1664539200">- Change the deprecated configure option --enable-hidden-symbols
  to the new --enable-symbol-hiding.</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665230400">- Update connection info when using UNIX socket as endpoint
  connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666785600">- Update to 7.86.0:
  * Security fixes:
  - POST following PUT confusion [bsc#1204383, CVE-2022-32221]
  - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260]
  - HTTP proxy double-free [bsc#1204385, CVE-2022-42915]
  - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916]
  * Changes:
  - NPN: remove support for and use of
  - Websockets: initial support
  * Bugfixes:
  - altsvc: reject bad port numbers
  - autotools: reduce brute-force when detecting recv/send arg list
  - aws_sigv4: fix header computation
  - cli tool: do not use disabled protocols
  - connect: change verbose IPv6 address:port to [address]:port
  - connect: fix builds without AF_INET6
  - connect: fix Curl_updateconninfo for TRNSPRT_UNIX
  - connect: fix the wrong error message on connect failures
  - content_encoding: use writer struct subclasses for different encodings
  - cookie: reject cookie names or content with TAB characters
  - curl/add_file_name_to_url: use the libcurl URL parser
  - curl/get_url_file_name: use libcurl URL parser
  - curl: warn for --ssl use, considered insecure
  - docs/libcurl/symbols-in-versions: add several missing symbols
  - ftp: ignore a 550 response to MDTM
  - functypes: provide the recv and send arg and return types
  - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled
  - header: define public API functions as extern c
  - headers: reset the requests counter at transfer start
  - hostip: guard PF_INET6 use
  - hostip: lazily wait to figure out if IPv6 works until needed
  - http, vauth: always provide Curl_allow_auth_to_host() functionality
  - http2: make nghttp2 less picky about field whitespace
  - http: try parsing Retry-After: as a number first
  - http_proxy: restore the protocol pointer on error
  - lib: add missing limits.h includes
  - lib: prepare the incoming of additional protocols
  - lib: sanitize conditional exclusion around MIME
  - libssh: if sftp_init fails, don't get the sftp error code
  - mprintf: reject two kinds of precision for the same argument
  - mqtt: return error for too long topic
  - netrc: compare user name case sensitively
  - netrc: replace fgets with Curl_get_line
  - netrc: use the URL-decoded user
  - ngtcp2: fix build errors due to changes in ngtcp2 library
  - noproxy: support proxies specified using cidr notation
  - openssl: make certinfo available for QUIC
  - resolve: make forced IPv4 resolve only use A queries
  - schannel: ban server ALPN change during recv renegotiation
  - schannel: don't reset recv/send function pointers on renegotiation
  - schannel: when importing PFX, disable key persistence
  - setopt: use the handler table for protocol name to number conversions
  - setopt: when POST is set, reset the 'upload' field
  - single_transfer: use the libcurl URL parser when appending query parts
  - smb: replace CURL_WIN32 with WIN32
  - tool: avoid generating ambiguous escaped characters in --libcurl
  - tool_main: exit at once if out of file descriptors
  - tool_operate: more transfer cleanup after parallel transfer fail
  - tool_operate: prevent over-queuing in parallel mode
  - tool_paramhelp: asserts verify maximum sizes for string loading
  - tool_xattr: save the original URL, not the final redirected one
  - url: a zero-length userinfo part in the URL is still a (blank) user
  - url: allow non-HTTPS HSTS-matching for debug builds
  - url: rename function due to name-clash in Watt-32
  - url: use IDN decoded names for HSTS checks
  - urlapi: detect scheme better when not guessing
  - urlapi: fix parsing URL without slash with CURLU_URLENCODE
  - urlapi: reject more bad characters from the host name field
  * Remove patch upstream:
  - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch</changelog>
  <changelog author="luc14n0@opensuse.org" date="1668600000">- Add 1.50.0 as the minimum libnghttp2 build requirement version as
  a bandaid. Curl's 7.86.0 release introduces the use of
  nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation,
  introduced by nghttp2 1.50.0 release, without introducing a check
  for the function/right version in their build scripts. This will
  make Zypper/cURL unusable in some corner cases where users
  installing something that requires libcurl4 before doing full
  system upgrade, thus updating the cURL stack, but not
  libnghttp2's. Background: boo#1204983, Factory mailing list
  threadd:
  "? broken dependency in curl and/or *zyp* ?", and forums thread:
  Curl-is-broken-after-an-update-which-subsequently-breaks-zypper.</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
  <changelog author="david.anes@suse.com" date="1671624000">- Update to 7.87.0:
  * Security fixes:
  - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN
  - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free
  * Changes
  - curl: add --url-query
  - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit
  - lib: add CURL_WRITEFUNC_ERROR to signal write callback error
  - openssl: reduce CA certificate bundle reparsing by caching
  - version: add a feature names array to curl_version_info_data
  * Bugfixes
  - altsvc: fix rejection of negative port numbers
  - aws_sigv4: consult x-%s-content-sha256 for payload hash
  - aws_sigv4: fix typos in aws_sigv4.c
  - base64: better alloc size
  - base64: encode without using snprintf
  - base64: faster base64 decoding
  - build: assume assert.h is always available
  - build: assume errno.h is always available
  - c-hyper: CONNECT respones are not server responses
  - c-hyper: fix multi-request mechanism
  - CI: Change FreeBSD image from 12.3 to 12.4
  - CI: LGTM.com will be shut down in December 2022
  - ci: Remove zuul fuzzing job as it's superseded by CIFuzz
  - cmake: check for cross-compile, not for toolchain
  - CMake: fix build with `CURL_USE_GSSAPI`
  - cmake: really enable warnings with clang
  - cmake: set the soname on the shared library
  - cmdline-opts/gen.pl: fix the linkifier
  - cmdline-opts/page-footer: remove long option nroff formatting
  - config-mac: define HAVE_SYS_IOCTL_H
  - config-mac: fix typo: size_T -&gt; size_t
  - config-mac: remove HAVE_SYS_SELECT_H
  - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW
  - configure: require fork for NTLM-WB
  - contributors.sh: actually use $CURLWWW instead of just setting it
  - cookie: compare cookie prefixes case insensitively
  - cookie: expire cookies at once when max-age is negative
  - cookie: open cookie jar as a binary file
  - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS
  - curl-rustls.m4: on macOS, rustls also needs the Security framework
  - curl.h: include &lt;sys/select.h&gt; on SerenityOS
  - curl.h: name all public function parameters
  - curl.h: reword comment to not use deprecated option
  - curl: override the numeric locale and set "C" by force
  - curl: timeout in the read callback
  - curl_endian: remove Curl_write64_le from header
  - curl_get_line: allow last line without newline char
  - curl_path: do not add '/' if homedir ends with one
  - curl_url_get.3: remove spurious backtick
  - curl_url_set.3: document CURLU_DISALLOW_USER
  - curl_url_set.3: fix typo
  - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE
  - CURLOPT_COOKIEFILE.3: advice =&gt; advise
  - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example
  - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw"
  - CURLOPT_POST.3: Explain setting to 0 changes request type
  - docs/curl_ws_send: Fixed typo in websocket docs
  - docs/EARLY-RELEASE.md: how to determine an early release
  - docs/examples: spell correction ('Retrieve')
  - docs/INSTALL.md: expand on static builds
  - docs/WEBSOCKET.md: explain the URL use
  - docs: add missing parameters for --retry flag
  - docs: add more "SEE ALSO" links to CA related pages
  - docs: explain the noproxy CIDR notation support
  - docs: extend the dump-header documentation
  - docs: remove performance note in CURLOPT_SSL_VERIFYPEER
  - examples/10-at-a-time: fix possible skipped final transfers
  - examples: update descriptions
  - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH
  - gen.pl: do not generate CURLHELP bitmask lines &gt; 79 characters
  - GHA: clarify workflows permissions, set least possible privilege
  - GHA: NSS use clang instead of clang-9
  - gnutls: use common gnutls init and verify code for ngtcp2
  - headers: add endif comments
  - HTTP-COOKIES.md: mention that http://localhost is a secure context
  - HTTP-COOKIES.md: update the 6265bis link to draft-11
  - http: do not send PROXY more than once
  - http: fix the ::1 comparison for IPv6 localhost for cookies
  - http: set 'this_is_a_follow' in the Location: logic
  - http: use the IDN decoded name in HSTS checks
  - hyper: classify headers as CONNECT and 1XX
  - hyper: fix handling of hyper_task's when reusing the same address
  - idn: remove Curl_win32_ascii_to_idn
  - INSTALL: update operating systems and CPU archs
  - KNOWN_BUGS: remove eight entries
  - lib1560: add some basic IDN host name tests
  - lib: connection filters (cfilter) addition to curl:
  - lib: feature deprecation warnings in gcc &gt;= 4.3
  - lib: fix some type mismatches and remove unneeded typecasts
  - lib: parse numbers with fixed known base 10
  - lib: remove bad set.opt_no_body assignments
  - lib: rewind BEFORE request instead of AFTER previous
  - lib: sync guard for Curl_getaddrinfo_ex() definition and use
  - lib: use size_t or int etc instead of longs
  - libcurl-errors.3: remove duplicate word
  - libssh2: return error when ssh_hostkeyfunc returns error
  - limit-rate.d: see also --rate
  - log2changes.pl: wrap long lines at 80 columns
  - Makefile.mk: address minor issues
  - Makefile.mk: improve a GNU Make hack
  - Makefile.mk: portable Makefile.m32
  - maketgz: set the right version in lib/libcurl.plist
  - mime: relax easy/mime structures binding
  - misc: Fix incorrect spelling
  - misc: remove duplicated include files
  - misc: typo and grammar fixes
  - negtelnetserver.py: have it call its close() method
  - netrc.d: provide mutext info
  - netware: remove leftover traces
  - noproxy: also match with adjacent comma
  - noproxy: guard against empty hostnames in noproxy check
  - noproxy: tailmatch like in 7.85.0 and earlier
  - nroff-scan.pl: detect double highlights
  - ntlm: improve comment for encrypt_des
  - ntlm: silence ubsan warning about copying from null target_info pointer
  - openssl/mbedtls: use %d for outputing port with failf (int)
  - openssl: prefix errors with '[lib]/[version]: '
  - os400: use platform socklen_t in Curl_getnameinfo_a
  - page-header: grammar improvement (display transfer rate)
  - proxy: refactor haproxy protocol handling as connection filter
  - README.md: remove badges and xmas-tree garnish
  - rtsp: fix RTSP auth
  - runtests: --no-debuginfod now disables DEBUGINFOD_URLS
  - runtests: do CRLF replacements per section only
  - scripts/checksrc.pl: detect duplicated include files
  - sendf: change Curl_read_plain to wrap Curl_recv_plain
  - sendf: remove unnecessary if condition
  - setup: do not require __MRC__ defined for Mac OS 9 builds
  - smb/telnet: do not free the protocol struct in *_done()
  - socks: fix username max size is 255 (0xFF)
  - spellcheck.words: remove 'github' as an accepted word
  - ssl-reqd.d: clarify that this is for upgrading connections only
  - strcase: use curl_str(n)equal for case insensitive matches
  - styled-output.d: this option does not work on Windows
  - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS
  - system.h: support 64-bit curl_off_t for NonStop 32-bit
  - test1421: fix typo
  - test3026: reduce runtime in legacy mingw builds
  - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+
  - tests: add authorityInfoAccess to generated certs
  - tests: add HTTP/3 test case, custom location for proper nghttpx
  - tls: backends use connection filters for IO, enabling HTTPS-proxy
  - tool: determine the correct fopen option for -D
  - tool_cfgable: free the ssl_ec_curves on exit
  - tool_cfgable: make socks5_gssapi_nec a boolean
  - tool_formparse: avoid clobbering on function params
  - tool_getparam: make --no-get work as the opposite of --get
  - tool_operate: provide better errmsg for -G with bad URL
  - tool_operate: when aborting, make sure there is a non-NULL error buffer
  - tool_paramhlp: free the proto strings on exit
  - url: move back the IDN conversion of proxy names
  - urlapi: reject more bad letters from the host name: &amp;+()
  - urldata: change port num storage to int and unsigned short
  - vms: remove SIZEOF_SHORT
  - vtls: fix build without proxy support
  - vtls: localization of state data in filters
  - WEBSOCKET.md: fix broken link
  - Websocket: fixes for partial frames and buffer updates
  - websockets: fix handling of partial frames
  - windows: fail early with a missing windres in autotools
  - windows: fix linking .rc to shared curl with autotools
  - winidn: drop WANT_IDN_PROTOTYPES
  - ws: if no connection is around, return error
  - ws: return CURLE_NOT_BUILT_IN when websockets not built in
  - x509asn1: avoid freeing unallocated pointers</changelog>
  <changelog author="pmonreal@suse.com" date="1675771200">- Security Fixes:
  * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914]
  * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915]
  * Add curl-CVE-2023-23914-23915.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771201">- Security Fix: [bsc#1207992, CVE-2023-23916]
  * HTTP multi-header compression denial of service
  * Add curl-CVE-2023-23916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1676462400">- Update to 7.88.0: [bsc#1207990, CVE-2023-23914]
  [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916]
  * Security fixes:
  - CVE-2023-23914: HSTS ignored on multiple requests
  - CVE-2023-23915: HSTS amnesia with --parallel
  - CVE-2023-23916: HTTP multi-header compression denial of service
  * Changes:
  - curl.h: add CURL_HTTP_VERSION_3ONLY
  - share: add sharing of HSTS cache among handles
  - src: add --http3-only
  - tool_operate: share HSTS between handles
  - urlapi: add CURLU_PUNYCODE
  - writeout: add %{certs} and %{num_certs}
  * Bugfixes:
  - cf-socket: keep sockaddr local in the socket filters
  - cfilters:Curl_conn_get_select_socks: use the first non-connected filter
  - curl.h: allow up to 10M buffer size
  - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated
  - curl/websockets.h: extend the websocket frame struct
  - curl: output warning at --verbose output for debug-enabled version
  - curl_free.3: fix return type of `curl_free`
  - curl_log: for failf/infof and debug logging implementations
  - dict: URL decode the entire path always
  - docs/DEPRECATE.md: deprecate gskit
  - easyoptions: fix header printing in generation script
  - haxproxy: send before TLS handhshake
  - hsts.d: explain hsts more
  - hsts: handle adding the same host name again
  - HTTP/[23]: continue upload when state.drain is set
  - http: decode transfer encoding first
  - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro
  - http_proxy: do not assign data-&gt;req.p.http use local copy
  - lib: connect/h2/h3 refactor
  - libssh2: try sha2 algos for hostkey methods
  - md4: fix build with GnuTLS + OpenSSL v1
  - ngtcp2: replace removed define and stop using removed function
  - noproxy: support for space-separated names is deprecated
  - nss: implement data_pending method
  - openldap: fix missing sasl symbols at build in specific configs
  - openssl: adapt to boringssl's error code type
  - openssl: don't ignore CA paths when using Windows CA store (redux)
  - openssl: don't log raw record headers
  - openssl: make the BIO_METHOD a local variable in the connection filter
  - openssl: only use CA_BLOB if verifying peer
  - openssl: remove attached easy handles from SSL instances
  - openssl: store the CA after first send (ClientHello)
  - setopt: use &gt;, not &gt;=, when checking if uarg is larger than uint-max
  - smb: return error on upload without size
  - socketpair: allow localhost MITM sniffers
  - strdup: name it Curl_strdup
  - tool_getparam: fix hiding of command line secrets
  - tool_operate: fix error codes on bad URL &amp; OOM
  - tool_operate: repair --rate
  - transfer: break the read loop when RECV is cleared
  - typecheck: accept expressions for option/info parameters
  - urlapi: avoid Curl_dyn_addf() for hex outputs
  - urlapi: skip path checks if path is just "/"
  - urlapi: skip the extra dedotdot alloc if no dot in path
  - urldata: cease storing TLS auth type
  - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP
  - urldata: make set.http200aliases conditional on HTTP being present
  - urldata: move the cookefilelist to the 'set' struct
  - urldata: remove unused struct fields, made more conditional
  - vquic: stabilization and improvements
  - vtls: fix hostname handling in filters
  - vtls: manage current easy handle in nested cfilter calls
  - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used
  * Rebase libcurl-ocloexec.patch
  * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091
  - runtests: fix "uninitialized value $port"
  - Add curl-fix-uninitialized-value-in-tests.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1676894400">- Update to 7.88.1:
  * Bugfix release
- Drop upstreamed patch:
  * curl-fix-uninitialized-value-in-tests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678708800">- Security fixes:
  * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection
    Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch
  * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy
    Add curl-CVE-2023-27534.patch
  * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse
    Add curl-CVE-2023-27535.patch
  * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use
    Add curl-CVE-2023-27536.patch
  * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still
    Add curl-CVE-2023-27538.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1679313600">- Update to 8.0.0:
  * Security fixes:
  - TELNET option IAC injection [bsc#1209209, CVE-2023-27533]
  - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534]
  - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535]
  - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536]
  - HSTS double-free [bsc#1209213, CVE-2023-27537]
  - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538]
  * Changes:
  - build: remove support for curl_off_t &lt; 8 bytes
  * Bugfixes:
  - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3
  - BINDINGS: add Fortran binding
  - cf-socket: use port 80 when resolving name for local bind
  - cookie: don't load cookies again when flushing
  - curl_path: create the new path with dynbuf
  - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe
  - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure
  - ftp: active mode with SSL, add the filter
  - hostip: avoid sscanf and extra buffer copies
  - http2: fix for http2-prior-knowledge when reusing connections
  - http2: fix handling of RST and GOAWAY to recognize partial transfers
  - http: don't send 100-continue for short PUT requests
  - http: fix unix domain socket use in https connects
  - libssh: use dynbuf instead of realloc
  - ngtcp2-gnutls.yml: bump to gnutls 3.8.0
  - sectransp: make read_cert() use a dynbuf when loading
  - telnet: only accept option arguments in ascii
  - telnet: parse telnet options without sscanf
  - url: fix the SSH connection reuse check
  - url: only reuse connections with same GSS delegation
  - urlapi: '%' is illegal in host names
  - ws: keep the socket non-blocking
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1679400000">- Update to 8.0.1:
  * Bugfixes:
  - fix crash in curl_easy_cleanup</changelog>
  <changelog author="pmonreal@suse.com" date="1681732800">- Update to 8.0.1: [jsc#PED-2580]
  * Rebase curl-secure-getenv.patch
  * Remove patches fixed in the update:
  - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch
  - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch
  - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch
  - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch
  - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch
  - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch
  - curl-CVE-2022-27774-disabletest-1568.patch
  - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch
  - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch
  - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch
  - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch
  - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch
  - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1683633600">- Security fixes:
  * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256
    fingerprint check.
  - Add curl-CVE-2023-28319.patch
  * [bsc#1211231, CVE-2023-28320] siglongjmp race condition
  - Add curl-CVE-2023-28320.patch
  * [bsc#1211232, CVE-2023-28321] IDN wildcard matching
  - Add curl-CVE-2023-28321.patch
  * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion
  - Add curl-CVE-2023-28322.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1689163200">- Security fix: [bsc#1213237, CVE-2023-32001]
  * fopen race condition: libcurl can be told to save cookie,
    HSTS and/or alt-svc data to files. When doing this, it
    called 'stat()' followed by 'fopen()' in a way that made
    it vulnerable to a TOCTOU race condition problem.
  * Add curl-CVE-2023-32001.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1694001600">- Security fix: [bsc#1215026, CVE-2023-38039]
  * http: return error when receiving too large header
  * Add curl-CVE-2023-38039.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1696334400">- Security fixes:
  * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow
  * [bsc#1215889, CVE-2023-38546] Cookie injection with none file
  * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch</changelog>
</package>
<package pkgid="fb5923d131be18a18658ef561323b8476442311472c64f171bc102c01bfbddfe" name="curl" arch="s390x">
  <version epoch="0" ver="8.0.1" rel="150400.5.32.1"/>
  <changelog author="pmonreal@suse.com" date="1664539200">- Change the deprecated configure option --enable-hidden-symbols
  to the new --enable-symbol-hiding.</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665230400">- Update connection info when using UNIX socket as endpoint
  connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666785600">- Update to 7.86.0:
  * Security fixes:
  - POST following PUT confusion [bsc#1204383, CVE-2022-32221]
  - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260]
  - HTTP proxy double-free [bsc#1204385, CVE-2022-42915]
  - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916]
  * Changes:
  - NPN: remove support for and use of
  - Websockets: initial support
  * Bugfixes:
  - altsvc: reject bad port numbers
  - autotools: reduce brute-force when detecting recv/send arg list
  - aws_sigv4: fix header computation
  - cli tool: do not use disabled protocols
  - connect: change verbose IPv6 address:port to [address]:port
  - connect: fix builds without AF_INET6
  - connect: fix Curl_updateconninfo for TRNSPRT_UNIX
  - connect: fix the wrong error message on connect failures
  - content_encoding: use writer struct subclasses for different encodings
  - cookie: reject cookie names or content with TAB characters
  - curl/add_file_name_to_url: use the libcurl URL parser
  - curl/get_url_file_name: use libcurl URL parser
  - curl: warn for --ssl use, considered insecure
  - docs/libcurl/symbols-in-versions: add several missing symbols
  - ftp: ignore a 550 response to MDTM
  - functypes: provide the recv and send arg and return types
  - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled
  - header: define public API functions as extern c
  - headers: reset the requests counter at transfer start
  - hostip: guard PF_INET6 use
  - hostip: lazily wait to figure out if IPv6 works until needed
  - http, vauth: always provide Curl_allow_auth_to_host() functionality
  - http2: make nghttp2 less picky about field whitespace
  - http: try parsing Retry-After: as a number first
  - http_proxy: restore the protocol pointer on error
  - lib: add missing limits.h includes
  - lib: prepare the incoming of additional protocols
  - lib: sanitize conditional exclusion around MIME
  - libssh: if sftp_init fails, don't get the sftp error code
  - mprintf: reject two kinds of precision for the same argument
  - mqtt: return error for too long topic
  - netrc: compare user name case sensitively
  - netrc: replace fgets with Curl_get_line
  - netrc: use the URL-decoded user
  - ngtcp2: fix build errors due to changes in ngtcp2 library
  - noproxy: support proxies specified using cidr notation
  - openssl: make certinfo available for QUIC
  - resolve: make forced IPv4 resolve only use A queries
  - schannel: ban server ALPN change during recv renegotiation
  - schannel: don't reset recv/send function pointers on renegotiation
  - schannel: when importing PFX, disable key persistence
  - setopt: use the handler table for protocol name to number conversions
  - setopt: when POST is set, reset the 'upload' field
  - single_transfer: use the libcurl URL parser when appending query parts
  - smb: replace CURL_WIN32 with WIN32
  - tool: avoid generating ambiguous escaped characters in --libcurl
  - tool_main: exit at once if out of file descriptors
  - tool_operate: more transfer cleanup after parallel transfer fail
  - tool_operate: prevent over-queuing in parallel mode
  - tool_paramhelp: asserts verify maximum sizes for string loading
  - tool_xattr: save the original URL, not the final redirected one
  - url: a zero-length userinfo part in the URL is still a (blank) user
  - url: allow non-HTTPS HSTS-matching for debug builds
  - url: rename function due to name-clash in Watt-32
  - url: use IDN decoded names for HSTS checks
  - urlapi: detect scheme better when not guessing
  - urlapi: fix parsing URL without slash with CURLU_URLENCODE
  - urlapi: reject more bad characters from the host name field
  * Remove patch upstream:
  - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch</changelog>
  <changelog author="luc14n0@opensuse.org" date="1668600000">- Add 1.50.0 as the minimum libnghttp2 build requirement version as
  a bandaid. Curl's 7.86.0 release introduces the use of
  nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation,
  introduced by nghttp2 1.50.0 release, without introducing a check
  for the function/right version in their build scripts. This will
  make Zypper/cURL unusable in some corner cases where users
  installing something that requires libcurl4 before doing full
  system upgrade, thus updating the cURL stack, but not
  libnghttp2's. Background: boo#1204983, Factory mailing list
  threadd:
  "? broken dependency in curl and/or *zyp* ?", and forums thread:
  Curl-is-broken-after-an-update-which-subsequently-breaks-zypper.</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
  <changelog author="david.anes@suse.com" date="1671624000">- Update to 7.87.0:
  * Security fixes:
  - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN
  - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free
  * Changes
  - curl: add --url-query
  - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit
  - lib: add CURL_WRITEFUNC_ERROR to signal write callback error
  - openssl: reduce CA certificate bundle reparsing by caching
  - version: add a feature names array to curl_version_info_data
  * Bugfixes
  - altsvc: fix rejection of negative port numbers
  - aws_sigv4: consult x-%s-content-sha256 for payload hash
  - aws_sigv4: fix typos in aws_sigv4.c
  - base64: better alloc size
  - base64: encode without using snprintf
  - base64: faster base64 decoding
  - build: assume assert.h is always available
  - build: assume errno.h is always available
  - c-hyper: CONNECT respones are not server responses
  - c-hyper: fix multi-request mechanism
  - CI: Change FreeBSD image from 12.3 to 12.4
  - CI: LGTM.com will be shut down in December 2022
  - ci: Remove zuul fuzzing job as it's superseded by CIFuzz
  - cmake: check for cross-compile, not for toolchain
  - CMake: fix build with `CURL_USE_GSSAPI`
  - cmake: really enable warnings with clang
  - cmake: set the soname on the shared library
  - cmdline-opts/gen.pl: fix the linkifier
  - cmdline-opts/page-footer: remove long option nroff formatting
  - config-mac: define HAVE_SYS_IOCTL_H
  - config-mac: fix typo: size_T -&gt; size_t
  - config-mac: remove HAVE_SYS_SELECT_H
  - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW
  - configure: require fork for NTLM-WB
  - contributors.sh: actually use $CURLWWW instead of just setting it
  - cookie: compare cookie prefixes case insensitively
  - cookie: expire cookies at once when max-age is negative
  - cookie: open cookie jar as a binary file
  - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS
  - curl-rustls.m4: on macOS, rustls also needs the Security framework
  - curl.h: include &lt;sys/select.h&gt; on SerenityOS
  - curl.h: name all public function parameters
  - curl.h: reword comment to not use deprecated option
  - curl: override the numeric locale and set "C" by force
  - curl: timeout in the read callback
  - curl_endian: remove Curl_write64_le from header
  - curl_get_line: allow last line without newline char
  - curl_path: do not add '/' if homedir ends with one
  - curl_url_get.3: remove spurious backtick
  - curl_url_set.3: document CURLU_DISALLOW_USER
  - curl_url_set.3: fix typo
  - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE
  - CURLOPT_COOKIEFILE.3: advice =&gt; advise
  - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example
  - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw"
  - CURLOPT_POST.3: Explain setting to 0 changes request type
  - docs/curl_ws_send: Fixed typo in websocket docs
  - docs/EARLY-RELEASE.md: how to determine an early release
  - docs/examples: spell correction ('Retrieve')
  - docs/INSTALL.md: expand on static builds
  - docs/WEBSOCKET.md: explain the URL use
  - docs: add missing parameters for --retry flag
  - docs: add more "SEE ALSO" links to CA related pages
  - docs: explain the noproxy CIDR notation support
  - docs: extend the dump-header documentation
  - docs: remove performance note in CURLOPT_SSL_VERIFYPEER
  - examples/10-at-a-time: fix possible skipped final transfers
  - examples: update descriptions
  - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH
  - gen.pl: do not generate CURLHELP bitmask lines &gt; 79 characters
  - GHA: clarify workflows permissions, set least possible privilege
  - GHA: NSS use clang instead of clang-9
  - gnutls: use common gnutls init and verify code for ngtcp2
  - headers: add endif comments
  - HTTP-COOKIES.md: mention that http://localhost is a secure context
  - HTTP-COOKIES.md: update the 6265bis link to draft-11
  - http: do not send PROXY more than once
  - http: fix the ::1 comparison for IPv6 localhost for cookies
  - http: set 'this_is_a_follow' in the Location: logic
  - http: use the IDN decoded name in HSTS checks
  - hyper: classify headers as CONNECT and 1XX
  - hyper: fix handling of hyper_task's when reusing the same address
  - idn: remove Curl_win32_ascii_to_idn
  - INSTALL: update operating systems and CPU archs
  - KNOWN_BUGS: remove eight entries
  - lib1560: add some basic IDN host name tests
  - lib: connection filters (cfilter) addition to curl:
  - lib: feature deprecation warnings in gcc &gt;= 4.3
  - lib: fix some type mismatches and remove unneeded typecasts
  - lib: parse numbers with fixed known base 10
  - lib: remove bad set.opt_no_body assignments
  - lib: rewind BEFORE request instead of AFTER previous
  - lib: sync guard for Curl_getaddrinfo_ex() definition and use
  - lib: use size_t or int etc instead of longs
  - libcurl-errors.3: remove duplicate word
  - libssh2: return error when ssh_hostkeyfunc returns error
  - limit-rate.d: see also --rate
  - log2changes.pl: wrap long lines at 80 columns
  - Makefile.mk: address minor issues
  - Makefile.mk: improve a GNU Make hack
  - Makefile.mk: portable Makefile.m32
  - maketgz: set the right version in lib/libcurl.plist
  - mime: relax easy/mime structures binding
  - misc: Fix incorrect spelling
  - misc: remove duplicated include files
  - misc: typo and grammar fixes
  - negtelnetserver.py: have it call its close() method
  - netrc.d: provide mutext info
  - netware: remove leftover traces
  - noproxy: also match with adjacent comma
  - noproxy: guard against empty hostnames in noproxy check
  - noproxy: tailmatch like in 7.85.0 and earlier
  - nroff-scan.pl: detect double highlights
  - ntlm: improve comment for encrypt_des
  - ntlm: silence ubsan warning about copying from null target_info pointer
  - openssl/mbedtls: use %d for outputing port with failf (int)
  - openssl: prefix errors with '[lib]/[version]: '
  - os400: use platform socklen_t in Curl_getnameinfo_a
  - page-header: grammar improvement (display transfer rate)
  - proxy: refactor haproxy protocol handling as connection filter
  - README.md: remove badges and xmas-tree garnish
  - rtsp: fix RTSP auth
  - runtests: --no-debuginfod now disables DEBUGINFOD_URLS
  - runtests: do CRLF replacements per section only
  - scripts/checksrc.pl: detect duplicated include files
  - sendf: change Curl_read_plain to wrap Curl_recv_plain
  - sendf: remove unnecessary if condition
  - setup: do not require __MRC__ defined for Mac OS 9 builds
  - smb/telnet: do not free the protocol struct in *_done()
  - socks: fix username max size is 255 (0xFF)
  - spellcheck.words: remove 'github' as an accepted word
  - ssl-reqd.d: clarify that this is for upgrading connections only
  - strcase: use curl_str(n)equal for case insensitive matches
  - styled-output.d: this option does not work on Windows
  - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS
  - system.h: support 64-bit curl_off_t for NonStop 32-bit
  - test1421: fix typo
  - test3026: reduce runtime in legacy mingw builds
  - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+
  - tests: add authorityInfoAccess to generated certs
  - tests: add HTTP/3 test case, custom location for proper nghttpx
  - tls: backends use connection filters for IO, enabling HTTPS-proxy
  - tool: determine the correct fopen option for -D
  - tool_cfgable: free the ssl_ec_curves on exit
  - tool_cfgable: make socks5_gssapi_nec a boolean
  - tool_formparse: avoid clobbering on function params
  - tool_getparam: make --no-get work as the opposite of --get
  - tool_operate: provide better errmsg for -G with bad URL
  - tool_operate: when aborting, make sure there is a non-NULL error buffer
  - tool_paramhlp: free the proto strings on exit
  - url: move back the IDN conversion of proxy names
  - urlapi: reject more bad letters from the host name: &amp;+()
  - urldata: change port num storage to int and unsigned short
  - vms: remove SIZEOF_SHORT
  - vtls: fix build without proxy support
  - vtls: localization of state data in filters
  - WEBSOCKET.md: fix broken link
  - Websocket: fixes for partial frames and buffer updates
  - websockets: fix handling of partial frames
  - windows: fail early with a missing windres in autotools
  - windows: fix linking .rc to shared curl with autotools
  - winidn: drop WANT_IDN_PROTOTYPES
  - ws: if no connection is around, return error
  - ws: return CURLE_NOT_BUILT_IN when websockets not built in
  - x509asn1: avoid freeing unallocated pointers</changelog>
  <changelog author="pmonreal@suse.com" date="1675771200">- Security Fixes:
  * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914]
  * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915]
  * Add curl-CVE-2023-23914-23915.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771201">- Security Fix: [bsc#1207992, CVE-2023-23916]
  * HTTP multi-header compression denial of service
  * Add curl-CVE-2023-23916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1676462400">- Update to 7.88.0: [bsc#1207990, CVE-2023-23914]
  [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916]
  * Security fixes:
  - CVE-2023-23914: HSTS ignored on multiple requests
  - CVE-2023-23915: HSTS amnesia with --parallel
  - CVE-2023-23916: HTTP multi-header compression denial of service
  * Changes:
  - curl.h: add CURL_HTTP_VERSION_3ONLY
  - share: add sharing of HSTS cache among handles
  - src: add --http3-only
  - tool_operate: share HSTS between handles
  - urlapi: add CURLU_PUNYCODE
  - writeout: add %{certs} and %{num_certs}
  * Bugfixes:
  - cf-socket: keep sockaddr local in the socket filters
  - cfilters:Curl_conn_get_select_socks: use the first non-connected filter
  - curl.h: allow up to 10M buffer size
  - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated
  - curl/websockets.h: extend the websocket frame struct
  - curl: output warning at --verbose output for debug-enabled version
  - curl_free.3: fix return type of `curl_free`
  - curl_log: for failf/infof and debug logging implementations
  - dict: URL decode the entire path always
  - docs/DEPRECATE.md: deprecate gskit
  - easyoptions: fix header printing in generation script
  - haxproxy: send before TLS handhshake
  - hsts.d: explain hsts more
  - hsts: handle adding the same host name again
  - HTTP/[23]: continue upload when state.drain is set
  - http: decode transfer encoding first
  - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro
  - http_proxy: do not assign data-&gt;req.p.http use local copy
  - lib: connect/h2/h3 refactor
  - libssh2: try sha2 algos for hostkey methods
  - md4: fix build with GnuTLS + OpenSSL v1
  - ngtcp2: replace removed define and stop using removed function
  - noproxy: support for space-separated names is deprecated
  - nss: implement data_pending method
  - openldap: fix missing sasl symbols at build in specific configs
  - openssl: adapt to boringssl's error code type
  - openssl: don't ignore CA paths when using Windows CA store (redux)
  - openssl: don't log raw record headers
  - openssl: make the BIO_METHOD a local variable in the connection filter
  - openssl: only use CA_BLOB if verifying peer
  - openssl: remove attached easy handles from SSL instances
  - openssl: store the CA after first send (ClientHello)
  - setopt: use &gt;, not &gt;=, when checking if uarg is larger than uint-max
  - smb: return error on upload without size
  - socketpair: allow localhost MITM sniffers
  - strdup: name it Curl_strdup
  - tool_getparam: fix hiding of command line secrets
  - tool_operate: fix error codes on bad URL &amp; OOM
  - tool_operate: repair --rate
  - transfer: break the read loop when RECV is cleared
  - typecheck: accept expressions for option/info parameters
  - urlapi: avoid Curl_dyn_addf() for hex outputs
  - urlapi: skip path checks if path is just "/"
  - urlapi: skip the extra dedotdot alloc if no dot in path
  - urldata: cease storing TLS auth type
  - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP
  - urldata: make set.http200aliases conditional on HTTP being present
  - urldata: move the cookefilelist to the 'set' struct
  - urldata: remove unused struct fields, made more conditional
  - vquic: stabilization and improvements
  - vtls: fix hostname handling in filters
  - vtls: manage current easy handle in nested cfilter calls
  - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used
  * Rebase libcurl-ocloexec.patch
  * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091
  - runtests: fix "uninitialized value $port"
  - Add curl-fix-uninitialized-value-in-tests.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1676894400">- Update to 7.88.1:
  * Bugfix release
- Drop upstreamed patch:
  * curl-fix-uninitialized-value-in-tests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678708800">- Security fixes:
  * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection
    Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch
  * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy
    Add curl-CVE-2023-27534.patch
  * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse
    Add curl-CVE-2023-27535.patch
  * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use
    Add curl-CVE-2023-27536.patch
  * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still
    Add curl-CVE-2023-27538.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1679313600">- Update to 8.0.0:
  * Security fixes:
  - TELNET option IAC injection [bsc#1209209, CVE-2023-27533]
  - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534]
  - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535]
  - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536]
  - HSTS double-free [bsc#1209213, CVE-2023-27537]
  - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538]
  * Changes:
  - build: remove support for curl_off_t &lt; 8 bytes
  * Bugfixes:
  - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3
  - BINDINGS: add Fortran binding
  - cf-socket: use port 80 when resolving name for local bind
  - cookie: don't load cookies again when flushing
  - curl_path: create the new path with dynbuf
  - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe
  - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure
  - ftp: active mode with SSL, add the filter
  - hostip: avoid sscanf and extra buffer copies
  - http2: fix for http2-prior-knowledge when reusing connections
  - http2: fix handling of RST and GOAWAY to recognize partial transfers
  - http: don't send 100-continue for short PUT requests
  - http: fix unix domain socket use in https connects
  - libssh: use dynbuf instead of realloc
  - ngtcp2-gnutls.yml: bump to gnutls 3.8.0
  - sectransp: make read_cert() use a dynbuf when loading
  - telnet: only accept option arguments in ascii
  - telnet: parse telnet options without sscanf
  - url: fix the SSH connection reuse check
  - url: only reuse connections with same GSS delegation
  - urlapi: '%' is illegal in host names
  - ws: keep the socket non-blocking
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1679400000">- Update to 8.0.1:
  * Bugfixes:
  - fix crash in curl_easy_cleanup</changelog>
  <changelog author="pmonreal@suse.com" date="1681732800">- Update to 8.0.1: [jsc#PED-2580]
  * Rebase curl-secure-getenv.patch
  * Remove patches fixed in the update:
  - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch
  - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch
  - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch
  - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch
  - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch
  - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch
  - curl-CVE-2022-27774-disabletest-1568.patch
  - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch
  - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch
  - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch
  - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch
  - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch
  - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1683633600">- Security fixes:
  * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256
    fingerprint check.
  - Add curl-CVE-2023-28319.patch
  * [bsc#1211231, CVE-2023-28320] siglongjmp race condition
  - Add curl-CVE-2023-28320.patch
  * [bsc#1211232, CVE-2023-28321] IDN wildcard matching
  - Add curl-CVE-2023-28321.patch
  * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion
  - Add curl-CVE-2023-28322.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1689163200">- Security fix: [bsc#1213237, CVE-2023-32001]
  * fopen race condition: libcurl can be told to save cookie,
    HSTS and/or alt-svc data to files. When doing this, it
    called 'stat()' followed by 'fopen()' in a way that made
    it vulnerable to a TOCTOU race condition problem.
  * Add curl-CVE-2023-32001.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1694001600">- Security fix: [bsc#1215026, CVE-2023-38039]
  * http: return error when receiving too large header
  * Add curl-CVE-2023-38039.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1696334400">- Security fixes:
  * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow
  * [bsc#1215889, CVE-2023-38546] Cookie injection with none file
  * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch</changelog>
</package>
<package pkgid="e3c3a5f408941dc3cf8e8126a55d4d979d455a28a842061f90cb044374be0d59" name="curl" arch="src">
  <version epoch="0" ver="8.0.1" rel="150400.5.32.1"/>
  <changelog author="pmonreal@suse.com" date="1664539200">- Change the deprecated configure option --enable-hidden-symbols
  to the new --enable-symbol-hiding.</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665230400">- Update connection info when using UNIX socket as endpoint
  connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666785600">- Update to 7.86.0:
  * Security fixes:
  - POST following PUT confusion [bsc#1204383, CVE-2022-32221]
  - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260]
  - HTTP proxy double-free [bsc#1204385, CVE-2022-42915]
  - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916]
  * Changes:
  - NPN: remove support for and use of
  - Websockets: initial support
  * Bugfixes:
  - altsvc: reject bad port numbers
  - autotools: reduce brute-force when detecting recv/send arg list
  - aws_sigv4: fix header computation
  - cli tool: do not use disabled protocols
  - connect: change verbose IPv6 address:port to [address]:port
  - connect: fix builds without AF_INET6
  - connect: fix Curl_updateconninfo for TRNSPRT_UNIX
  - connect: fix the wrong error message on connect failures
  - content_encoding: use writer struct subclasses for different encodings
  - cookie: reject cookie names or content with TAB characters
  - curl/add_file_name_to_url: use the libcurl URL parser
  - curl/get_url_file_name: use libcurl URL parser
  - curl: warn for --ssl use, considered insecure
  - docs/libcurl/symbols-in-versions: add several missing symbols
  - ftp: ignore a 550 response to MDTM
  - functypes: provide the recv and send arg and return types
  - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled
  - header: define public API functions as extern c
  - headers: reset the requests counter at transfer start
  - hostip: guard PF_INET6 use
  - hostip: lazily wait to figure out if IPv6 works until needed
  - http, vauth: always provide Curl_allow_auth_to_host() functionality
  - http2: make nghttp2 less picky about field whitespace
  - http: try parsing Retry-After: as a number first
  - http_proxy: restore the protocol pointer on error
  - lib: add missing limits.h includes
  - lib: prepare the incoming of additional protocols
  - lib: sanitize conditional exclusion around MIME
  - libssh: if sftp_init fails, don't get the sftp error code
  - mprintf: reject two kinds of precision for the same argument
  - mqtt: return error for too long topic
  - netrc: compare user name case sensitively
  - netrc: replace fgets with Curl_get_line
  - netrc: use the URL-decoded user
  - ngtcp2: fix build errors due to changes in ngtcp2 library
  - noproxy: support proxies specified using cidr notation
  - openssl: make certinfo available for QUIC
  - resolve: make forced IPv4 resolve only use A queries
  - schannel: ban server ALPN change during recv renegotiation
  - schannel: don't reset recv/send function pointers on renegotiation
  - schannel: when importing PFX, disable key persistence
  - setopt: use the handler table for protocol name to number conversions
  - setopt: when POST is set, reset the 'upload' field
  - single_transfer: use the libcurl URL parser when appending query parts
  - smb: replace CURL_WIN32 with WIN32
  - tool: avoid generating ambiguous escaped characters in --libcurl
  - tool_main: exit at once if out of file descriptors
  - tool_operate: more transfer cleanup after parallel transfer fail
  - tool_operate: prevent over-queuing in parallel mode
  - tool_paramhelp: asserts verify maximum sizes for string loading
  - tool_xattr: save the original URL, not the final redirected one
  - url: a zero-length userinfo part in the URL is still a (blank) user
  - url: allow non-HTTPS HSTS-matching for debug builds
  - url: rename function due to name-clash in Watt-32
  - url: use IDN decoded names for HSTS checks
  - urlapi: detect scheme better when not guessing
  - urlapi: fix parsing URL without slash with CURLU_URLENCODE
  - urlapi: reject more bad characters from the host name field
  * Remove patch upstream:
  - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch</changelog>
  <changelog author="luc14n0@opensuse.org" date="1668600000">- Add 1.50.0 as the minimum libnghttp2 build requirement version as
  a bandaid. Curl's 7.86.0 release introduces the use of
  nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation,
  introduced by nghttp2 1.50.0 release, without introducing a check
  for the function/right version in their build scripts. This will
  make Zypper/cURL unusable in some corner cases where users
  installing something that requires libcurl4 before doing full
  system upgrade, thus updating the cURL stack, but not
  libnghttp2's. Background: boo#1204983, Factory mailing list
  threadd:
  "? broken dependency in curl and/or *zyp* ?", and forums thread:
  Curl-is-broken-after-an-update-which-subsequently-breaks-zypper.</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
  <changelog author="david.anes@suse.com" date="1671624000">- Update to 7.87.0:
  * Security fixes:
  - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN
  - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free
  * Changes
  - curl: add --url-query
  - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit
  - lib: add CURL_WRITEFUNC_ERROR to signal write callback error
  - openssl: reduce CA certificate bundle reparsing by caching
  - version: add a feature names array to curl_version_info_data
  * Bugfixes
  - altsvc: fix rejection of negative port numbers
  - aws_sigv4: consult x-%s-content-sha256 for payload hash
  - aws_sigv4: fix typos in aws_sigv4.c
  - base64: better alloc size
  - base64: encode without using snprintf
  - base64: faster base64 decoding
  - build: assume assert.h is always available
  - build: assume errno.h is always available
  - c-hyper: CONNECT respones are not server responses
  - c-hyper: fix multi-request mechanism
  - CI: Change FreeBSD image from 12.3 to 12.4
  - CI: LGTM.com will be shut down in December 2022
  - ci: Remove zuul fuzzing job as it's superseded by CIFuzz
  - cmake: check for cross-compile, not for toolchain
  - CMake: fix build with `CURL_USE_GSSAPI`
  - cmake: really enable warnings with clang
  - cmake: set the soname on the shared library
  - cmdline-opts/gen.pl: fix the linkifier
  - cmdline-opts/page-footer: remove long option nroff formatting
  - config-mac: define HAVE_SYS_IOCTL_H
  - config-mac: fix typo: size_T -&gt; size_t
  - config-mac: remove HAVE_SYS_SELECT_H
  - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW
  - configure: require fork for NTLM-WB
  - contributors.sh: actually use $CURLWWW instead of just setting it
  - cookie: compare cookie prefixes case insensitively
  - cookie: expire cookies at once when max-age is negative
  - cookie: open cookie jar as a binary file
  - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS
  - curl-rustls.m4: on macOS, rustls also needs the Security framework
  - curl.h: include &lt;sys/select.h&gt; on SerenityOS
  - curl.h: name all public function parameters
  - curl.h: reword comment to not use deprecated option
  - curl: override the numeric locale and set "C" by force
  - curl: timeout in the read callback
  - curl_endian: remove Curl_write64_le from header
  - curl_get_line: allow last line without newline char
  - curl_path: do not add '/' if homedir ends with one
  - curl_url_get.3: remove spurious backtick
  - curl_url_set.3: document CURLU_DISALLOW_USER
  - curl_url_set.3: fix typo
  - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE
  - CURLOPT_COOKIEFILE.3: advice =&gt; advise
  - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example
  - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw"
  - CURLOPT_POST.3: Explain setting to 0 changes request type
  - docs/curl_ws_send: Fixed typo in websocket docs
  - docs/EARLY-RELEASE.md: how to determine an early release
  - docs/examples: spell correction ('Retrieve')
  - docs/INSTALL.md: expand on static builds
  - docs/WEBSOCKET.md: explain the URL use
  - docs: add missing parameters for --retry flag
  - docs: add more "SEE ALSO" links to CA related pages
  - docs: explain the noproxy CIDR notation support
  - docs: extend the dump-header documentation
  - docs: remove performance note in CURLOPT_SSL_VERIFYPEER
  - examples/10-at-a-time: fix possible skipped final transfers
  - examples: update descriptions
  - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH
  - gen.pl: do not generate CURLHELP bitmask lines &gt; 79 characters
  - GHA: clarify workflows permissions, set least possible privilege
  - GHA: NSS use clang instead of clang-9
  - gnutls: use common gnutls init and verify code for ngtcp2
  - headers: add endif comments
  - HTTP-COOKIES.md: mention that http://localhost is a secure context
  - HTTP-COOKIES.md: update the 6265bis link to draft-11
  - http: do not send PROXY more than once
  - http: fix the ::1 comparison for IPv6 localhost for cookies
  - http: set 'this_is_a_follow' in the Location: logic
  - http: use the IDN decoded name in HSTS checks
  - hyper: classify headers as CONNECT and 1XX
  - hyper: fix handling of hyper_task's when reusing the same address
  - idn: remove Curl_win32_ascii_to_idn
  - INSTALL: update operating systems and CPU archs
  - KNOWN_BUGS: remove eight entries
  - lib1560: add some basic IDN host name tests
  - lib: connection filters (cfilter) addition to curl:
  - lib: feature deprecation warnings in gcc &gt;= 4.3
  - lib: fix some type mismatches and remove unneeded typecasts
  - lib: parse numbers with fixed known base 10
  - lib: remove bad set.opt_no_body assignments
  - lib: rewind BEFORE request instead of AFTER previous
  - lib: sync guard for Curl_getaddrinfo_ex() definition and use
  - lib: use size_t or int etc instead of longs
  - libcurl-errors.3: remove duplicate word
  - libssh2: return error when ssh_hostkeyfunc returns error
  - limit-rate.d: see also --rate
  - log2changes.pl: wrap long lines at 80 columns
  - Makefile.mk: address minor issues
  - Makefile.mk: improve a GNU Make hack
  - Makefile.mk: portable Makefile.m32
  - maketgz: set the right version in lib/libcurl.plist
  - mime: relax easy/mime structures binding
  - misc: Fix incorrect spelling
  - misc: remove duplicated include files
  - misc: typo and grammar fixes
  - negtelnetserver.py: have it call its close() method
  - netrc.d: provide mutext info
  - netware: remove leftover traces
  - noproxy: also match with adjacent comma
  - noproxy: guard against empty hostnames in noproxy check
  - noproxy: tailmatch like in 7.85.0 and earlier
  - nroff-scan.pl: detect double highlights
  - ntlm: improve comment for encrypt_des
  - ntlm: silence ubsan warning about copying from null target_info pointer
  - openssl/mbedtls: use %d for outputing port with failf (int)
  - openssl: prefix errors with '[lib]/[version]: '
  - os400: use platform socklen_t in Curl_getnameinfo_a
  - page-header: grammar improvement (display transfer rate)
  - proxy: refactor haproxy protocol handling as connection filter
  - README.md: remove badges and xmas-tree garnish
  - rtsp: fix RTSP auth
  - runtests: --no-debuginfod now disables DEBUGINFOD_URLS
  - runtests: do CRLF replacements per section only
  - scripts/checksrc.pl: detect duplicated include files
  - sendf: change Curl_read_plain to wrap Curl_recv_plain
  - sendf: remove unnecessary if condition
  - setup: do not require __MRC__ defined for Mac OS 9 builds
  - smb/telnet: do not free the protocol struct in *_done()
  - socks: fix username max size is 255 (0xFF)
  - spellcheck.words: remove 'github' as an accepted word
  - ssl-reqd.d: clarify that this is for upgrading connections only
  - strcase: use curl_str(n)equal for case insensitive matches
  - styled-output.d: this option does not work on Windows
  - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS
  - system.h: support 64-bit curl_off_t for NonStop 32-bit
  - test1421: fix typo
  - test3026: reduce runtime in legacy mingw builds
  - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+
  - tests: add authorityInfoAccess to generated certs
  - tests: add HTTP/3 test case, custom location for proper nghttpx
  - tls: backends use connection filters for IO, enabling HTTPS-proxy
  - tool: determine the correct fopen option for -D
  - tool_cfgable: free the ssl_ec_curves on exit
  - tool_cfgable: make socks5_gssapi_nec a boolean
  - tool_formparse: avoid clobbering on function params
  - tool_getparam: make --no-get work as the opposite of --get
  - tool_operate: provide better errmsg for -G with bad URL
  - tool_operate: when aborting, make sure there is a non-NULL error buffer
  - tool_paramhlp: free the proto strings on exit
  - url: move back the IDN conversion of proxy names
  - urlapi: reject more bad letters from the host name: &amp;+()
  - urldata: change port num storage to int and unsigned short
  - vms: remove SIZEOF_SHORT
  - vtls: fix build without proxy support
  - vtls: localization of state data in filters
  - WEBSOCKET.md: fix broken link
  - Websocket: fixes for partial frames and buffer updates
  - websockets: fix handling of partial frames
  - windows: fail early with a missing windres in autotools
  - windows: fix linking .rc to shared curl with autotools
  - winidn: drop WANT_IDN_PROTOTYPES
  - ws: if no connection is around, return error
  - ws: return CURLE_NOT_BUILT_IN when websockets not built in
  - x509asn1: avoid freeing unallocated pointers</changelog>
  <changelog author="pmonreal@suse.com" date="1675771200">- Security Fixes:
  * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914]
  * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915]
  * Add curl-CVE-2023-23914-23915.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771201">- Security Fix: [bsc#1207992, CVE-2023-23916]
  * HTTP multi-header compression denial of service
  * Add curl-CVE-2023-23916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1676462400">- Update to 7.88.0: [bsc#1207990, CVE-2023-23914]
  [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916]
  * Security fixes:
  - CVE-2023-23914: HSTS ignored on multiple requests
  - CVE-2023-23915: HSTS amnesia with --parallel
  - CVE-2023-23916: HTTP multi-header compression denial of service
  * Changes:
  - curl.h: add CURL_HTTP_VERSION_3ONLY
  - share: add sharing of HSTS cache among handles
  - src: add --http3-only
  - tool_operate: share HSTS between handles
  - urlapi: add CURLU_PUNYCODE
  - writeout: add %{certs} and %{num_certs}
  * Bugfixes:
  - cf-socket: keep sockaddr local in the socket filters
  - cfilters:Curl_conn_get_select_socks: use the first non-connected filter
  - curl.h: allow up to 10M buffer size
  - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated
  - curl/websockets.h: extend the websocket frame struct
  - curl: output warning at --verbose output for debug-enabled version
  - curl_free.3: fix return type of `curl_free`
  - curl_log: for failf/infof and debug logging implementations
  - dict: URL decode the entire path always
  - docs/DEPRECATE.md: deprecate gskit
  - easyoptions: fix header printing in generation script
  - haxproxy: send before TLS handhshake
  - hsts.d: explain hsts more
  - hsts: handle adding the same host name again
  - HTTP/[23]: continue upload when state.drain is set
  - http: decode transfer encoding first
  - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro
  - http_proxy: do not assign data-&gt;req.p.http use local copy
  - lib: connect/h2/h3 refactor
  - libssh2: try sha2 algos for hostkey methods
  - md4: fix build with GnuTLS + OpenSSL v1
  - ngtcp2: replace removed define and stop using removed function
  - noproxy: support for space-separated names is deprecated
  - nss: implement data_pending method
  - openldap: fix missing sasl symbols at build in specific configs
  - openssl: adapt to boringssl's error code type
  - openssl: don't ignore CA paths when using Windows CA store (redux)
  - openssl: don't log raw record headers
  - openssl: make the BIO_METHOD a local variable in the connection filter
  - openssl: only use CA_BLOB if verifying peer
  - openssl: remove attached easy handles from SSL instances
  - openssl: store the CA after first send (ClientHello)
  - setopt: use &gt;, not &gt;=, when checking if uarg is larger than uint-max
  - smb: return error on upload without size
  - socketpair: allow localhost MITM sniffers
  - strdup: name it Curl_strdup
  - tool_getparam: fix hiding of command line secrets
  - tool_operate: fix error codes on bad URL &amp; OOM
  - tool_operate: repair --rate
  - transfer: break the read loop when RECV is cleared
  - typecheck: accept expressions for option/info parameters
  - urlapi: avoid Curl_dyn_addf() for hex outputs
  - urlapi: skip path checks if path is just "/"
  - urlapi: skip the extra dedotdot alloc if no dot in path
  - urldata: cease storing TLS auth type
  - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP
  - urldata: make set.http200aliases conditional on HTTP being present
  - urldata: move the cookefilelist to the 'set' struct
  - urldata: remove unused struct fields, made more conditional
  - vquic: stabilization and improvements
  - vtls: fix hostname handling in filters
  - vtls: manage current easy handle in nested cfilter calls
  - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used
  * Rebase libcurl-ocloexec.patch
  * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091
  - runtests: fix "uninitialized value $port"
  - Add curl-fix-uninitialized-value-in-tests.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1676894400">- Update to 7.88.1:
  * Bugfix release
- Drop upstreamed patch:
  * curl-fix-uninitialized-value-in-tests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678708800">- Security fixes:
  * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection
    Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch
  * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy
    Add curl-CVE-2023-27534.patch
  * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse
    Add curl-CVE-2023-27535.patch
  * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use
    Add curl-CVE-2023-27536.patch
  * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still
    Add curl-CVE-2023-27538.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1679313600">- Update to 8.0.0:
  * Security fixes:
  - TELNET option IAC injection [bsc#1209209, CVE-2023-27533]
  - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534]
  - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535]
  - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536]
  - HSTS double-free [bsc#1209213, CVE-2023-27537]
  - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538]
  * Changes:
  - build: remove support for curl_off_t &lt; 8 bytes
  * Bugfixes:
  - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3
  - BINDINGS: add Fortran binding
  - cf-socket: use port 80 when resolving name for local bind
  - cookie: don't load cookies again when flushing
  - curl_path: create the new path with dynbuf
  - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe
  - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure
  - ftp: active mode with SSL, add the filter
  - hostip: avoid sscanf and extra buffer copies
  - http2: fix for http2-prior-knowledge when reusing connections
  - http2: fix handling of RST and GOAWAY to recognize partial transfers
  - http: don't send 100-continue for short PUT requests
  - http: fix unix domain socket use in https connects
  - libssh: use dynbuf instead of realloc
  - ngtcp2-gnutls.yml: bump to gnutls 3.8.0
  - sectransp: make read_cert() use a dynbuf when loading
  - telnet: only accept option arguments in ascii
  - telnet: parse telnet options without sscanf
  - url: fix the SSH connection reuse check
  - url: only reuse connections with same GSS delegation
  - urlapi: '%' is illegal in host names
  - ws: keep the socket non-blocking
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1679400000">- Update to 8.0.1:
  * Bugfixes:
  - fix crash in curl_easy_cleanup</changelog>
  <changelog author="pmonreal@suse.com" date="1681732800">- Update to 8.0.1: [jsc#PED-2580]
  * Rebase curl-secure-getenv.patch
  * Remove patches fixed in the update:
  - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch
  - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch
  - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch
  - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch
  - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch
  - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch
  - curl-CVE-2022-27774-disabletest-1568.patch
  - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch
  - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch
  - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch
  - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch
  - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch
  - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1683633600">- Security fixes:
  * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256
    fingerprint check.
  - Add curl-CVE-2023-28319.patch
  * [bsc#1211231, CVE-2023-28320] siglongjmp race condition
  - Add curl-CVE-2023-28320.patch
  * [bsc#1211232, CVE-2023-28321] IDN wildcard matching
  - Add curl-CVE-2023-28321.patch
  * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion
  - Add curl-CVE-2023-28322.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1689163200">- Security fix: [bsc#1213237, CVE-2023-32001]
  * fopen race condition: libcurl can be told to save cookie,
    HSTS and/or alt-svc data to files. When doing this, it
    called 'stat()' followed by 'fopen()' in a way that made
    it vulnerable to a TOCTOU race condition problem.
  * Add curl-CVE-2023-32001.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1694001600">- Security fix: [bsc#1215026, CVE-2023-38039]
  * http: return error when receiving too large header
  * Add curl-CVE-2023-38039.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1696334400">- Security fixes:
  * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow
  * [bsc#1215889, CVE-2023-38546] Cookie injection with none file
  * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch</changelog>
</package>
<package pkgid="e92e64cb25e1dc17228d9301a46a87a955807c79c093a12fe795aa8d457dc125" name="curl" arch="x86_64">
  <version epoch="0" ver="8.0.1" rel="150400.5.32.1"/>
  <changelog author="pmonreal@suse.com" date="1664539200">- Change the deprecated configure option --enable-hidden-symbols
  to the new --enable-symbol-hiding.</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665230400">- Update connection info when using UNIX socket as endpoint
  connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666785600">- Update to 7.86.0:
  * Security fixes:
  - POST following PUT confusion [bsc#1204383, CVE-2022-32221]
  - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260]
  - HTTP proxy double-free [bsc#1204385, CVE-2022-42915]
  - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916]
  * Changes:
  - NPN: remove support for and use of
  - Websockets: initial support
  * Bugfixes:
  - altsvc: reject bad port numbers
  - autotools: reduce brute-force when detecting recv/send arg list
  - aws_sigv4: fix header computation
  - cli tool: do not use disabled protocols
  - connect: change verbose IPv6 address:port to [address]:port
  - connect: fix builds without AF_INET6
  - connect: fix Curl_updateconninfo for TRNSPRT_UNIX
  - connect: fix the wrong error message on connect failures
  - content_encoding: use writer struct subclasses for different encodings
  - cookie: reject cookie names or content with TAB characters
  - curl/add_file_name_to_url: use the libcurl URL parser
  - curl/get_url_file_name: use libcurl URL parser
  - curl: warn for --ssl use, considered insecure
  - docs/libcurl/symbols-in-versions: add several missing symbols
  - ftp: ignore a 550 response to MDTM
  - functypes: provide the recv and send arg and return types
  - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled
  - header: define public API functions as extern c
  - headers: reset the requests counter at transfer start
  - hostip: guard PF_INET6 use
  - hostip: lazily wait to figure out if IPv6 works until needed
  - http, vauth: always provide Curl_allow_auth_to_host() functionality
  - http2: make nghttp2 less picky about field whitespace
  - http: try parsing Retry-After: as a number first
  - http_proxy: restore the protocol pointer on error
  - lib: add missing limits.h includes
  - lib: prepare the incoming of additional protocols
  - lib: sanitize conditional exclusion around MIME
  - libssh: if sftp_init fails, don't get the sftp error code
  - mprintf: reject two kinds of precision for the same argument
  - mqtt: return error for too long topic
  - netrc: compare user name case sensitively
  - netrc: replace fgets with Curl_get_line
  - netrc: use the URL-decoded user
  - ngtcp2: fix build errors due to changes in ngtcp2 library
  - noproxy: support proxies specified using cidr notation
  - openssl: make certinfo available for QUIC
  - resolve: make forced IPv4 resolve only use A queries
  - schannel: ban server ALPN change during recv renegotiation
  - schannel: don't reset recv/send function pointers on renegotiation
  - schannel: when importing PFX, disable key persistence
  - setopt: use the handler table for protocol name to number conversions
  - setopt: when POST is set, reset the 'upload' field
  - single_transfer: use the libcurl URL parser when appending query parts
  - smb: replace CURL_WIN32 with WIN32
  - tool: avoid generating ambiguous escaped characters in --libcurl
  - tool_main: exit at once if out of file descriptors
  - tool_operate: more transfer cleanup after parallel transfer fail
  - tool_operate: prevent over-queuing in parallel mode
  - tool_paramhelp: asserts verify maximum sizes for string loading
  - tool_xattr: save the original URL, not the final redirected one
  - url: a zero-length userinfo part in the URL is still a (blank) user
  - url: allow non-HTTPS HSTS-matching for debug builds
  - url: rename function due to name-clash in Watt-32
  - url: use IDN decoded names for HSTS checks
  - urlapi: detect scheme better when not guessing
  - urlapi: fix parsing URL without slash with CURLU_URLENCODE
  - urlapi: reject more bad characters from the host name field
  * Remove patch upstream:
  - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch</changelog>
  <changelog author="luc14n0@opensuse.org" date="1668600000">- Add 1.50.0 as the minimum libnghttp2 build requirement version as
  a bandaid. Curl's 7.86.0 release introduces the use of
  nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation,
  introduced by nghttp2 1.50.0 release, without introducing a check
  for the function/right version in their build scripts. This will
  make Zypper/cURL unusable in some corner cases where users
  installing something that requires libcurl4 before doing full
  system upgrade, thus updating the cURL stack, but not
  libnghttp2's. Background: boo#1204983, Factory mailing list
  threadd:
  "? broken dependency in curl and/or *zyp* ?", and forums thread:
  Curl-is-broken-after-an-update-which-subsequently-breaks-zypper.</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
  <changelog author="david.anes@suse.com" date="1671624000">- Update to 7.87.0:
  * Security fixes:
  - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN
  - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free
  * Changes
  - curl: add --url-query
  - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit
  - lib: add CURL_WRITEFUNC_ERROR to signal write callback error
  - openssl: reduce CA certificate bundle reparsing by caching
  - version: add a feature names array to curl_version_info_data
  * Bugfixes
  - altsvc: fix rejection of negative port numbers
  - aws_sigv4: consult x-%s-content-sha256 for payload hash
  - aws_sigv4: fix typos in aws_sigv4.c
  - base64: better alloc size
  - base64: encode without using snprintf
  - base64: faster base64 decoding
  - build: assume assert.h is always available
  - build: assume errno.h is always available
  - c-hyper: CONNECT respones are not server responses
  - c-hyper: fix multi-request mechanism
  - CI: Change FreeBSD image from 12.3 to 12.4
  - CI: LGTM.com will be shut down in December 2022
  - ci: Remove zuul fuzzing job as it's superseded by CIFuzz
  - cmake: check for cross-compile, not for toolchain
  - CMake: fix build with `CURL_USE_GSSAPI`
  - cmake: really enable warnings with clang
  - cmake: set the soname on the shared library
  - cmdline-opts/gen.pl: fix the linkifier
  - cmdline-opts/page-footer: remove long option nroff formatting
  - config-mac: define HAVE_SYS_IOCTL_H
  - config-mac: fix typo: size_T -&gt; size_t
  - config-mac: remove HAVE_SYS_SELECT_H
  - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW
  - configure: require fork for NTLM-WB
  - contributors.sh: actually use $CURLWWW instead of just setting it
  - cookie: compare cookie prefixes case insensitively
  - cookie: expire cookies at once when max-age is negative
  - cookie: open cookie jar as a binary file
  - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS
  - curl-rustls.m4: on macOS, rustls also needs the Security framework
  - curl.h: include &lt;sys/select.h&gt; on SerenityOS
  - curl.h: name all public function parameters
  - curl.h: reword comment to not use deprecated option
  - curl: override the numeric locale and set "C" by force
  - curl: timeout in the read callback
  - curl_endian: remove Curl_write64_le from header
  - curl_get_line: allow last line without newline char
  - curl_path: do not add '/' if homedir ends with one
  - curl_url_get.3: remove spurious backtick
  - curl_url_set.3: document CURLU_DISALLOW_USER
  - curl_url_set.3: fix typo
  - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE
  - CURLOPT_COOKIEFILE.3: advice =&gt; advise
  - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example
  - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw"
  - CURLOPT_POST.3: Explain setting to 0 changes request type
  - docs/curl_ws_send: Fixed typo in websocket docs
  - docs/EARLY-RELEASE.md: how to determine an early release
  - docs/examples: spell correction ('Retrieve')
  - docs/INSTALL.md: expand on static builds
  - docs/WEBSOCKET.md: explain the URL use
  - docs: add missing parameters for --retry flag
  - docs: add more "SEE ALSO" links to CA related pages
  - docs: explain the noproxy CIDR notation support
  - docs: extend the dump-header documentation
  - docs: remove performance note in CURLOPT_SSL_VERIFYPEER
  - examples/10-at-a-time: fix possible skipped final transfers
  - examples: update descriptions
  - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH
  - gen.pl: do not generate CURLHELP bitmask lines &gt; 79 characters
  - GHA: clarify workflows permissions, set least possible privilege
  - GHA: NSS use clang instead of clang-9
  - gnutls: use common gnutls init and verify code for ngtcp2
  - headers: add endif comments
  - HTTP-COOKIES.md: mention that http://localhost is a secure context
  - HTTP-COOKIES.md: update the 6265bis link to draft-11
  - http: do not send PROXY more than once
  - http: fix the ::1 comparison for IPv6 localhost for cookies
  - http: set 'this_is_a_follow' in the Location: logic
  - http: use the IDN decoded name in HSTS checks
  - hyper: classify headers as CONNECT and 1XX
  - hyper: fix handling of hyper_task's when reusing the same address
  - idn: remove Curl_win32_ascii_to_idn
  - INSTALL: update operating systems and CPU archs
  - KNOWN_BUGS: remove eight entries
  - lib1560: add some basic IDN host name tests
  - lib: connection filters (cfilter) addition to curl:
  - lib: feature deprecation warnings in gcc &gt;= 4.3
  - lib: fix some type mismatches and remove unneeded typecasts
  - lib: parse numbers with fixed known base 10
  - lib: remove bad set.opt_no_body assignments
  - lib: rewind BEFORE request instead of AFTER previous
  - lib: sync guard for Curl_getaddrinfo_ex() definition and use
  - lib: use size_t or int etc instead of longs
  - libcurl-errors.3: remove duplicate word
  - libssh2: return error when ssh_hostkeyfunc returns error
  - limit-rate.d: see also --rate
  - log2changes.pl: wrap long lines at 80 columns
  - Makefile.mk: address minor issues
  - Makefile.mk: improve a GNU Make hack
  - Makefile.mk: portable Makefile.m32
  - maketgz: set the right version in lib/libcurl.plist
  - mime: relax easy/mime structures binding
  - misc: Fix incorrect spelling
  - misc: remove duplicated include files
  - misc: typo and grammar fixes
  - negtelnetserver.py: have it call its close() method
  - netrc.d: provide mutext info
  - netware: remove leftover traces
  - noproxy: also match with adjacent comma
  - noproxy: guard against empty hostnames in noproxy check
  - noproxy: tailmatch like in 7.85.0 and earlier
  - nroff-scan.pl: detect double highlights
  - ntlm: improve comment for encrypt_des
  - ntlm: silence ubsan warning about copying from null target_info pointer
  - openssl/mbedtls: use %d for outputing port with failf (int)
  - openssl: prefix errors with '[lib]/[version]: '
  - os400: use platform socklen_t in Curl_getnameinfo_a
  - page-header: grammar improvement (display transfer rate)
  - proxy: refactor haproxy protocol handling as connection filter
  - README.md: remove badges and xmas-tree garnish
  - rtsp: fix RTSP auth
  - runtests: --no-debuginfod now disables DEBUGINFOD_URLS
  - runtests: do CRLF replacements per section only
  - scripts/checksrc.pl: detect duplicated include files
  - sendf: change Curl_read_plain to wrap Curl_recv_plain
  - sendf: remove unnecessary if condition
  - setup: do not require __MRC__ defined for Mac OS 9 builds
  - smb/telnet: do not free the protocol struct in *_done()
  - socks: fix username max size is 255 (0xFF)
  - spellcheck.words: remove 'github' as an accepted word
  - ssl-reqd.d: clarify that this is for upgrading connections only
  - strcase: use curl_str(n)equal for case insensitive matches
  - styled-output.d: this option does not work on Windows
  - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS
  - system.h: support 64-bit curl_off_t for NonStop 32-bit
  - test1421: fix typo
  - test3026: reduce runtime in legacy mingw builds
  - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+
  - tests: add authorityInfoAccess to generated certs
  - tests: add HTTP/3 test case, custom location for proper nghttpx
  - tls: backends use connection filters for IO, enabling HTTPS-proxy
  - tool: determine the correct fopen option for -D
  - tool_cfgable: free the ssl_ec_curves on exit
  - tool_cfgable: make socks5_gssapi_nec a boolean
  - tool_formparse: avoid clobbering on function params
  - tool_getparam: make --no-get work as the opposite of --get
  - tool_operate: provide better errmsg for -G with bad URL
  - tool_operate: when aborting, make sure there is a non-NULL error buffer
  - tool_paramhlp: free the proto strings on exit
  - url: move back the IDN conversion of proxy names
  - urlapi: reject more bad letters from the host name: &amp;+()
  - urldata: change port num storage to int and unsigned short
  - vms: remove SIZEOF_SHORT
  - vtls: fix build without proxy support
  - vtls: localization of state data in filters
  - WEBSOCKET.md: fix broken link
  - Websocket: fixes for partial frames and buffer updates
  - websockets: fix handling of partial frames
  - windows: fail early with a missing windres in autotools
  - windows: fix linking .rc to shared curl with autotools
  - winidn: drop WANT_IDN_PROTOTYPES
  - ws: if no connection is around, return error
  - ws: return CURLE_NOT_BUILT_IN when websockets not built in
  - x509asn1: avoid freeing unallocated pointers</changelog>
  <changelog author="pmonreal@suse.com" date="1675771200">- Security Fixes:
  * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914]
  * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915]
  * Add curl-CVE-2023-23914-23915.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771201">- Security Fix: [bsc#1207992, CVE-2023-23916]
  * HTTP multi-header compression denial of service
  * Add curl-CVE-2023-23916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1676462400">- Update to 7.88.0: [bsc#1207990, CVE-2023-23914]
  [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916]
  * Security fixes:
  - CVE-2023-23914: HSTS ignored on multiple requests
  - CVE-2023-23915: HSTS amnesia with --parallel
  - CVE-2023-23916: HTTP multi-header compression denial of service
  * Changes:
  - curl.h: add CURL_HTTP_VERSION_3ONLY
  - share: add sharing of HSTS cache among handles
  - src: add --http3-only
  - tool_operate: share HSTS between handles
  - urlapi: add CURLU_PUNYCODE
  - writeout: add %{certs} and %{num_certs}
  * Bugfixes:
  - cf-socket: keep sockaddr local in the socket filters
  - cfilters:Curl_conn_get_select_socks: use the first non-connected filter
  - curl.h: allow up to 10M buffer size
  - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated
  - curl/websockets.h: extend the websocket frame struct
  - curl: output warning at --verbose output for debug-enabled version
  - curl_free.3: fix return type of `curl_free`
  - curl_log: for failf/infof and debug logging implementations
  - dict: URL decode the entire path always
  - docs/DEPRECATE.md: deprecate gskit
  - easyoptions: fix header printing in generation script
  - haxproxy: send before TLS handhshake
  - hsts.d: explain hsts more
  - hsts: handle adding the same host name again
  - HTTP/[23]: continue upload when state.drain is set
  - http: decode transfer encoding first
  - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro
  - http_proxy: do not assign data-&gt;req.p.http use local copy
  - lib: connect/h2/h3 refactor
  - libssh2: try sha2 algos for hostkey methods
  - md4: fix build with GnuTLS + OpenSSL v1
  - ngtcp2: replace removed define and stop using removed function
  - noproxy: support for space-separated names is deprecated
  - nss: implement data_pending method
  - openldap: fix missing sasl symbols at build in specific configs
  - openssl: adapt to boringssl's error code type
  - openssl: don't ignore CA paths when using Windows CA store (redux)
  - openssl: don't log raw record headers
  - openssl: make the BIO_METHOD a local variable in the connection filter
  - openssl: only use CA_BLOB if verifying peer
  - openssl: remove attached easy handles from SSL instances
  - openssl: store the CA after first send (ClientHello)
  - setopt: use &gt;, not &gt;=, when checking if uarg is larger than uint-max
  - smb: return error on upload without size
  - socketpair: allow localhost MITM sniffers
  - strdup: name it Curl_strdup
  - tool_getparam: fix hiding of command line secrets
  - tool_operate: fix error codes on bad URL &amp; OOM
  - tool_operate: repair --rate
  - transfer: break the read loop when RECV is cleared
  - typecheck: accept expressions for option/info parameters
  - urlapi: avoid Curl_dyn_addf() for hex outputs
  - urlapi: skip path checks if path is just "/"
  - urlapi: skip the extra dedotdot alloc if no dot in path
  - urldata: cease storing TLS auth type
  - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP
  - urldata: make set.http200aliases conditional on HTTP being present
  - urldata: move the cookefilelist to the 'set' struct
  - urldata: remove unused struct fields, made more conditional
  - vquic: stabilization and improvements
  - vtls: fix hostname handling in filters
  - vtls: manage current easy handle in nested cfilter calls
  - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used
  * Rebase libcurl-ocloexec.patch
  * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091
  - runtests: fix "uninitialized value $port"
  - Add curl-fix-uninitialized-value-in-tests.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1676894400">- Update to 7.88.1:
  * Bugfix release
- Drop upstreamed patch:
  * curl-fix-uninitialized-value-in-tests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678708800">- Security fixes:
  * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection
    Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch
  * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy
    Add curl-CVE-2023-27534.patch
  * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse
    Add curl-CVE-2023-27535.patch
  * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use
    Add curl-CVE-2023-27536.patch
  * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still
    Add curl-CVE-2023-27538.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1679313600">- Update to 8.0.0:
  * Security fixes:
  - TELNET option IAC injection [bsc#1209209, CVE-2023-27533]
  - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534]
  - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535]
  - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536]
  - HSTS double-free [bsc#1209213, CVE-2023-27537]
  - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538]
  * Changes:
  - build: remove support for curl_off_t &lt; 8 bytes
  * Bugfixes:
  - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3
  - BINDINGS: add Fortran binding
  - cf-socket: use port 80 when resolving name for local bind
  - cookie: don't load cookies again when flushing
  - curl_path: create the new path with dynbuf
  - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe
  - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure
  - ftp: active mode with SSL, add the filter
  - hostip: avoid sscanf and extra buffer copies
  - http2: fix for http2-prior-knowledge when reusing connections
  - http2: fix handling of RST and GOAWAY to recognize partial transfers
  - http: don't send 100-continue for short PUT requests
  - http: fix unix domain socket use in https connects
  - libssh: use dynbuf instead of realloc
  - ngtcp2-gnutls.yml: bump to gnutls 3.8.0
  - sectransp: make read_cert() use a dynbuf when loading
  - telnet: only accept option arguments in ascii
  - telnet: parse telnet options without sscanf
  - url: fix the SSH connection reuse check
  - url: only reuse connections with same GSS delegation
  - urlapi: '%' is illegal in host names
  - ws: keep the socket non-blocking
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1679400000">- Update to 8.0.1:
  * Bugfixes:
  - fix crash in curl_easy_cleanup</changelog>
  <changelog author="pmonreal@suse.com" date="1681732800">- Update to 8.0.1: [jsc#PED-2580]
  * Rebase curl-secure-getenv.patch
  * Remove patches fixed in the update:
  - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch
  - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch
  - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch
  - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch
  - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch
  - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch
  - curl-CVE-2022-27774-disabletest-1568.patch
  - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch
  - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch
  - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch
  - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch
  - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch
  - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1683633600">- Security fixes:
  * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256
    fingerprint check.
  - Add curl-CVE-2023-28319.patch
  * [bsc#1211231, CVE-2023-28320] siglongjmp race condition
  - Add curl-CVE-2023-28320.patch
  * [bsc#1211232, CVE-2023-28321] IDN wildcard matching
  - Add curl-CVE-2023-28321.patch
  * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion
  - Add curl-CVE-2023-28322.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1689163200">- Security fix: [bsc#1213237, CVE-2023-32001]
  * fopen race condition: libcurl can be told to save cookie,
    HSTS and/or alt-svc data to files. When doing this, it
    called 'stat()' followed by 'fopen()' in a way that made
    it vulnerable to a TOCTOU race condition problem.
  * Add curl-CVE-2023-32001.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1694001600">- Security fix: [bsc#1215026, CVE-2023-38039]
  * http: return error when receiving too large header
  * Add curl-CVE-2023-38039.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1696334400">- Security fixes:
  * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow
  * [bsc#1215889, CVE-2023-38546] Cookie injection with none file
  * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch</changelog>
</package>
<package pkgid="40e573578141089eff65a9343e1262fc9ea665807e0a46acd2dba6f065b6bef8" name="dracut" arch="aarch64">
  <version epoch="0" ver="055+suse.371.g5237e44a" rel="150500.3.12.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692360000">- Update to version 055+suse.369.gde6c81bf:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1695384000">- Update to version 055+suse.371.g5237e44a:
  * fix(nvmf): support /etc/nvme/config.json (bsc#1215578)</changelog>
</package>
<package pkgid="c20d87498570ba204e8e80e590e43fa4d2b40cabfc1556e0c2d12829af476394" name="dracut" arch="s390x">
  <version epoch="0" ver="055+suse.371.g5237e44a" rel="150500.3.12.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692360000">- Update to version 055+suse.369.gde6c81bf:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1695384000">- Update to version 055+suse.371.g5237e44a:
  * fix(nvmf): support /etc/nvme/config.json (bsc#1215578)</changelog>
</package>
<package pkgid="9afb3cb094e58c2291a163e9f14e4cabacd740bc17065ff826f86d4956608d08" name="dracut" arch="src">
  <version epoch="0" ver="055+suse.371.g5237e44a" rel="150500.3.12.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692360000">- Update to version 055+suse.369.gde6c81bf:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1695384000">- Update to version 055+suse.371.g5237e44a:
  * fix(nvmf): support /etc/nvme/config.json (bsc#1215578)</changelog>
</package>
<package pkgid="60460696c1ab819a45d4d0c91518a9c8beda23cfaea12b3ffa3476f2139ef46d" name="dracut" arch="x86_64">
  <version epoch="0" ver="055+suse.371.g5237e44a" rel="150500.3.12.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692360000">- Update to version 055+suse.369.gde6c81bf:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1695384000">- Update to version 055+suse.371.g5237e44a:
  * fix(nvmf): support /etc/nvme/config.json (bsc#1215578)</changelog>
</package>
<package pkgid="f9ceb458b618359e18359ee04af0d613af12fca50dcccfbbfa5f2451f0ac7fbb" name="dracut-fips" arch="aarch64">
  <version epoch="0" ver="055+suse.371.g5237e44a" rel="150500.3.12.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692360000">- Update to version 055+suse.369.gde6c81bf:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1695384000">- Update to version 055+suse.371.g5237e44a:
  * fix(nvmf): support /etc/nvme/config.json (bsc#1215578)</changelog>
</package>
<package pkgid="7ef1bf8d46889225a63b9bd85afc15a833851ff0a761e961f5c1c0a82d5b2889" name="dracut-fips" arch="s390x">
  <version epoch="0" ver="055+suse.371.g5237e44a" rel="150500.3.12.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692360000">- Update to version 055+suse.369.gde6c81bf:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1695384000">- Update to version 055+suse.371.g5237e44a:
  * fix(nvmf): support /etc/nvme/config.json (bsc#1215578)</changelog>
</package>
<package pkgid="a88cbc957cee21c0bd621c5f10f17af9556a802d527559543b692e7d41c4530b" name="dracut-fips" arch="x86_64">
  <version epoch="0" ver="055+suse.371.g5237e44a" rel="150500.3.12.1"/>
  <changelog author="antonio.feijoo@suse.com" date="1646913600">- Update to version 055+suse.242.g76ae5ce4:
  * fix(multipath): align multipathd.service type with upstream (bsc#1196958)
  * fix(systemd-sysusers): use split systemd sysuser configs (bsc#1196223)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1647259200">- Update to version 055+suse.244.g2f624182:
  * fix(resume): only exclude this module when swap is netdev (bsc#1194915)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1649160000">- Update to version 055+suse.248.g92d06110:
  * fix(resume): correct call to block_is_netdevice function (bsc#1197737)
  * chore(suse): remove fipscheck requirement (bsc#1198065)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651147200">- Update to version 055+suse.252.g4988b0bf:
  * fix(resume): do not add this module if there is no suitable swap (bsc#1198095)
  * feat(resume): improve sanity check by verifying volatile swap (bsc#1198095)
  * feat(resume): sanity check (bsc#1197192)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1651665600">- Update to version 055+suse.271.g70f710e4:
  * fix(nfs): /var is not mounted during the transactional-update run (bsc#1184970)
  * fix(nfs): give /run/rpcbind ownership to rpc user (bsc#1177461)
  * fix(dracut-install): copy files preserving ownership attributes (bsc#1197967)
  * fix(crypt): remove quotes from cryptsetupopts (bsc#1197635)
  * fix(lvm): restore setting LVM_MD_PV_ACTIVATED (bsc#1195604)
  * fix(iscsi): remove unneeded iscsi NOP-disable code (bsc#1196267)
  * fix(dracut-systemd): do not require vconsole-setup.service (bsc#1195508)
  * fix(bluetooth): make hostonly configuration files optional (bsc#1195047)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1654862400">- Update to version 055+suse.279.g3b3c36b2:
  * fix(bluetooth): accept compressed firmwares in inst_multiple (bsc#1200236)
  * fix(network-legacy): support rd.net.timeout.dhcp (bsc#1200360)
  * fix(convertfs): ignore commented lines in fstab (bsc#1200251)
  * fix(integrity): do not display any error if there is no IMA certificate (bsc#1187654)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659441600">- Update to version 055+suse.283.ge98ece25:
  * fix(network-manager): check for nm-initrd-generator in both /usr/{libexec,lib} (bsc#1201975)
  * fix(network-legacy): add auto timeout to wicked DHCP test (bsc#1198709)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1659700800">- Update to version 055+suse.294.gc5bc4bb5:
  Missing network-manager module fixes (bsc#1201975):
  * fix(network-manager): avoid calling unavailable dracut-logger functions
  * fix(network-manager): skip non-directories in /sys/class/net
  * fix(network-manager): disable tty output if the console is not usable
  * fix(network-manager): show output on console only with rd.debug enabled
  * fix(network-manager): write DHCP filename option to dhcpopts file
  * fix(network-manager): ensure safe content of /tmp/dhclient."$ifname".dhcpopts
  * fix(network-manager): include nm-daemon-helper binary
  * fix(network-manager): don't pull in systemd-udev-settle
  * fix(network-manager): support teaming under NM+systemd
  * fix(network-manager): pull in network.target in nm-initrd.service</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1664452800">- Update to version 055+suse.300.ge878982d:
  * chore(suse): change default persistent policy (jsc#PED-1885)
  * fix(systemd): add missing modprobe@.service (bsc#1203749)
  * fix(i18n): do not fail if FONT in /etc/vconsole.conf has the file extension (bsc#1203267)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1665748800">- Update to version 055+suse.306.g5b4feffc:
  * fix(network-legacy): misleading duplicate address detection using wicked (bsc#1201235)
  * fix(dmsquash-live): correct regression introduced with shellcheck changes (bsc#1203894)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1667390400">- Update to version 055+suse.325.g6780025c:
  * fix(network-manager): always install the library plugins directory (bsc#1202014)
  * feat(dracut-init.sh): add inst_libdir_dir() helper (bsc#1202014)
  A series of fixes for NVMeoF boot (bsc#1203368):
  * fix(man): dracut.cmdline.7: clarify "rd.nvmf.discover=fc,auto"
  * fix(network): avoid double brackets around IPv6 address
  * feat(nvmf): set rd.neednet=1 if tcp records encountered
  * fix(man): dracut.cmdline(7): correct syntax for rd.nonvmf
  * fix(network): don't use same ifname multiple times
  * fix(nvmf): run cmdline hook before parse-ip-opts.sh
  * fix(nvmf): avoid calling "exit" in a cmdline hook
  * fix(nvmf): make sure "rd.nvmf.discover=fc,auto" takes precedence
  * fix(nvmf): don't use "finished" queue for autoconnect
  * fix(nvmf): don't create did-setup file
  * fix(nvmf): no need to load the nvme module
  * fix(nvmf): don't try to validate network connections in cmdline hook
  * fix(nvmf): nvme list-subsys prints the address using commas as separator
  * fix(nvmf): deprecate old nvmf cmdline options
  * fix(nvmf): set executable bit on nvmf-autoconnect.sh</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1670932800">- Update to version 055+suse.333.g39325ba0:
  * feat(kernel-modules): exclude USB drivers in strict hostonly mode (bsc#1186056)
  * fix(multipath): warn if included with no multipath devices and no user conf (bsc#1069169)
  * fix(dracut.sh): improve detection of installed kernel versions (bsc#1205175)
  * fix(nfs): chown using rpc default group (bsc#1204929)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1674216000">- Update to version 055+suse.343.g0113f4b9:
  A series of changes for the NVMeoF boot feature (jsc#PED-1449):
  * fix(dracut.spec): require jq for nvmf
  * fix(suse/dracut.spec): require program for duplicate IP address detection
  * fix(iscsi): install 8021q module unconditionally
  * fix(nvmf): install 8021q module unconditionally
  * feat(nvmf): enable module if NBFT exists
  * feat(nvmf): add NBFT connect support, and fix configuration priority
  * feat(nvmf): add code for parsing the NBFT
  * fix(dracut.spec): require libopenssl1_1-hmac for dracut-fips (bsc#1206439)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1675771200">- Update to version 055+suse.345.g8b8708cb:
  * feat(lvm): always include all drivers that LVM can use (bsc#1206195)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1678881600">- Update to version 055+suse.353.g5603b001:
  A series of changes for the NVMeoF boot with IPv6 (bsc#1209166):
  * fix(nvmf): move connect logic to initqueue script
  * fix(nvmf): don't assume prefix lenth 64 by default
  * fix(nvmf): prefix syntax for static iBFT IPv6 addresses
  * fix(network): IPv6: don't wait for RA for static IPv6 assignments
  * fix(network-legacy): always include af_packet
  * fix(network): don't assume prefix lenth 64 by default
  * fix(iscsi): prefix syntax for static iBFT IPv6 addresses</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1682510400">- Update to version 055+suse.360.g076f1113:
  * fix(network-legacy): handle do_dhcp calls without arguments (bsc#1210640)
  fips=1 and separate /boot break s390x (bsc#1204478):
  * fix(fips): move fips-boot script to pre-pivot
  * fix(fips): only unmount /boot if it was mounted by the fips module
  * feat(fips): add progress messages
  * fix(fips): do not blindly remove /boot</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1685966400">- Update to version 055+suse.364.g4c1d0276:
  * fix(nvmf): honor rd.timeout for nvme ctrl_loss_tmo (bsc#1211080)
  * fix(nvmf): suppress pointless warning if hostname is not set (bsc#1211072)
  * fix(nvmf): set netroot=nbft (bsc#1210909)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1687780800">- Update to version 055+suse.366.g14047665:
  * fix(dracut-install): continue parsing if ldd prints "cannot execute binary file" (bsc#1212662)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1692360000">- Update to version 055+suse.369.gde6c81bf:
  * fix(dracut-install): protect against broken links pointing to themselves
  * fix(dracut.sh): exit if resolving executable dependencies fails (bsc#1214081)</changelog>
  <changelog author="antonio.feijoo@suse.com" date="1695384000">- Update to version 055+suse.371.g5237e44a:
  * fix(nvmf): support /etc/nvme/config.json (bsc#1215578)</changelog>
</package>
<package pkgid="ce68b0d67b811e335e369cffda796fe030aad13bb4456ea2b83faec6a7525bc0" name="dracut-kiwi-lib" arch="aarch64">
  <version epoch="0" ver="9.24.43" rel="150100.3.62.1"/>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 → 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 → 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 → 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
  <changelog author="dcassany@suse.com" date="1680177600">- Add parted dependency for s390
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6)</changelog>
  <changelog author="dcassany@suse.com" date="1680523200">- Expand DASD partition table with parted
  Fixes bsc#1209247
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9)</changelog>
  <changelog author="dcassany@suse.com" date="1681300800">- Use parted only in s390 arch
  This commit ensures parted is only called in dracut-kiwi-lib for s390
  arch. It also fixes the spec to only require parted for
  s390 builds.
  In addition parted requirement has been removed from dracut-kiwi-live
  package since parted is not used in any other dracut module beyond
  kiwi-lib.
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488)</changelog>
  <changelog author="dcassany@suse.com" date="1681300801">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
</package>
<package pkgid="66f8c51551b33bb50b95e51bc19686fa8af84099079457397f6303d36b0e3510" name="dracut-kiwi-lib" arch="s390x">
  <version epoch="0" ver="9.24.43" rel="150100.3.62.1"/>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 → 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 → 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 → 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
  <changelog author="dcassany@suse.com" date="1680177600">- Add parted dependency for s390
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6)</changelog>
  <changelog author="dcassany@suse.com" date="1680523200">- Expand DASD partition table with parted
  Fixes bsc#1209247
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9)</changelog>
  <changelog author="dcassany@suse.com" date="1681300800">- Use parted only in s390 arch
  This commit ensures parted is only called in dracut-kiwi-lib for s390
  arch. It also fixes the spec to only require parted for
  s390 builds.
  In addition parted requirement has been removed from dracut-kiwi-live
  package since parted is not used in any other dracut module beyond
  kiwi-lib.
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488)</changelog>
  <changelog author="dcassany@suse.com" date="1681300801">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
</package>
<package pkgid="1013b7f33fce5167b1e00164c2e51ce657faff2fc215f96eedbcd36c5a7264e1" name="dracut-kiwi-lib" arch="x86_64">
  <version epoch="0" ver="9.24.43" rel="150100.3.62.1"/>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 → 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 → 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 → 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
  <changelog author="dcassany@suse.com" date="1680177600">- Add parted dependency for s390
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6)</changelog>
  <changelog author="dcassany@suse.com" date="1680523200">- Expand DASD partition table with parted
  Fixes bsc#1209247
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9)</changelog>
  <changelog author="dcassany@suse.com" date="1681300800">- Use parted only in s390 arch
  This commit ensures parted is only called in dracut-kiwi-lib for s390
  arch. It also fixes the spec to only require parted for
  s390 builds.
  In addition parted requirement has been removed from dracut-kiwi-live
  package since parted is not used in any other dracut module beyond
  kiwi-lib.
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488)</changelog>
  <changelog author="dcassany@suse.com" date="1681300801">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
</package>
<package pkgid="28b5238048b0c08d133566a9fbb7aec1e2c941b51f7729130f38225df8ba65db" name="dracut-kiwi-oem-dump" arch="aarch64">
  <version epoch="0" ver="9.24.43" rel="150100.3.62.1"/>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 → 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 → 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 → 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
  <changelog author="dcassany@suse.com" date="1680177600">- Add parted dependency for s390
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6)</changelog>
  <changelog author="dcassany@suse.com" date="1680523200">- Expand DASD partition table with parted
  Fixes bsc#1209247
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9)</changelog>
  <changelog author="dcassany@suse.com" date="1681300800">- Use parted only in s390 arch
  This commit ensures parted is only called in dracut-kiwi-lib for s390
  arch. It also fixes the spec to only require parted for
  s390 builds.
  In addition parted requirement has been removed from dracut-kiwi-live
  package since parted is not used in any other dracut module beyond
  kiwi-lib.
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488)</changelog>
  <changelog author="dcassany@suse.com" date="1681300801">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
</package>
<package pkgid="d6f1b5b59d7875ef5a189570fb939dff12466d6e078db632f9bf060fe745a9db" name="dracut-kiwi-oem-dump" arch="s390x">
  <version epoch="0" ver="9.24.43" rel="150100.3.62.1"/>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 → 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 → 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 → 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
  <changelog author="dcassany@suse.com" date="1680177600">- Add parted dependency for s390
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6)</changelog>
  <changelog author="dcassany@suse.com" date="1680523200">- Expand DASD partition table with parted
  Fixes bsc#1209247
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9)</changelog>
  <changelog author="dcassany@suse.com" date="1681300800">- Use parted only in s390 arch
  This commit ensures parted is only called in dracut-kiwi-lib for s390
  arch. It also fixes the spec to only require parted for
  s390 builds.
  In addition parted requirement has been removed from dracut-kiwi-live
  package since parted is not used in any other dracut module beyond
  kiwi-lib.
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488)</changelog>
  <changelog author="dcassany@suse.com" date="1681300801">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
</package>
<package pkgid="0a8678c6ec501b7d540ad111c944046e1aea063dc1183c2a87aab6e191e519fa" name="dracut-kiwi-oem-dump" arch="x86_64">
  <version epoch="0" ver="9.24.43" rel="150100.3.62.1"/>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 → 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 → 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 → 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
  <changelog author="dcassany@suse.com" date="1680177600">- Add parted dependency for s390
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6)</changelog>
  <changelog author="dcassany@suse.com" date="1680523200">- Expand DASD partition table with parted
  Fixes bsc#1209247
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9)</changelog>
  <changelog author="dcassany@suse.com" date="1681300800">- Use parted only in s390 arch
  This commit ensures parted is only called in dracut-kiwi-lib for s390
  arch. It also fixes the spec to only require parted for
  s390 builds.
  In addition parted requirement has been removed from dracut-kiwi-live
  package since parted is not used in any other dracut module beyond
  kiwi-lib.
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488)</changelog>
  <changelog author="dcassany@suse.com" date="1681300801">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
</package>
<package pkgid="aa7740e01794215cddf495e99b217576c647dfcf394dbfe0577e49e3bc905db7" name="dracut-kiwi-oem-repart" arch="aarch64">
  <version epoch="0" ver="9.24.43" rel="150100.3.62.1"/>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 → 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 → 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 → 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
  <changelog author="dcassany@suse.com" date="1680177600">- Add parted dependency for s390
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6)</changelog>
  <changelog author="dcassany@suse.com" date="1680523200">- Expand DASD partition table with parted
  Fixes bsc#1209247
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9)</changelog>
  <changelog author="dcassany@suse.com" date="1681300800">- Use parted only in s390 arch
  This commit ensures parted is only called in dracut-kiwi-lib for s390
  arch. It also fixes the spec to only require parted for
  s390 builds.
  In addition parted requirement has been removed from dracut-kiwi-live
  package since parted is not used in any other dracut module beyond
  kiwi-lib.
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488)</changelog>
  <changelog author="dcassany@suse.com" date="1681300801">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
</package>
<package pkgid="03993b88d69e8bf5a7ce04ee7787e886f7163bbb0ab2efa50de1981056001553" name="dracut-kiwi-oem-repart" arch="s390x">
  <version epoch="0" ver="9.24.43" rel="150100.3.62.1"/>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 → 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 → 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 → 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
  <changelog author="dcassany@suse.com" date="1680177600">- Add parted dependency for s390
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6)</changelog>
  <changelog author="dcassany@suse.com" date="1680523200">- Expand DASD partition table with parted
  Fixes bsc#1209247
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9)</changelog>
  <changelog author="dcassany@suse.com" date="1681300800">- Use parted only in s390 arch
  This commit ensures parted is only called in dracut-kiwi-lib for s390
  arch. It also fixes the spec to only require parted for
  s390 builds.
  In addition parted requirement has been removed from dracut-kiwi-live
  package since parted is not used in any other dracut module beyond
  kiwi-lib.
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488)</changelog>
  <changelog author="dcassany@suse.com" date="1681300801">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
</package>
<package pkgid="a443c1297f99be70a036cf7d64964ee6c9ffb773fe05032ef7328646eff70a5b" name="dracut-kiwi-oem-repart" arch="x86_64">
  <version epoch="0" ver="9.24.43" rel="150100.3.62.1"/>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 → 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 → 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 → 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
  <changelog author="dcassany@suse.com" date="1680177600">- Add parted dependency for s390
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6)</changelog>
  <changelog author="dcassany@suse.com" date="1680523200">- Expand DASD partition table with parted
  Fixes bsc#1209247
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9)</changelog>
  <changelog author="dcassany@suse.com" date="1681300800">- Use parted only in s390 arch
  This commit ensures parted is only called in dracut-kiwi-lib for s390
  arch. It also fixes the spec to only require parted for
  s390 builds.
  In addition parted requirement has been removed from dracut-kiwi-live
  package since parted is not used in any other dracut module beyond
  kiwi-lib.
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488)</changelog>
  <changelog author="dcassany@suse.com" date="1681300801">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
</package>
<package pkgid="d01e771eead0ca67f082a3438cb442116903fc7f0baa044c4d63a3caf3d08b36" name="gcc13" arch="src">
  <version epoch="0" ver="13.2.1+git7813" rel="150000.1.3.3"/>
  <changelog author="mliska@suse.cz" date="1679659200">- Use --enable-link-serialization rather that --enable-link-mutex,
  the benefit of the former one is that the linker jobs are not
  holding tokens of the make's jobserver.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1679659201">- Add %limit_build for gcc13 to avoid OOM</changelog>
  <changelog author="mliska@suse.cz" date="1680609600">- Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995.</changelog>
  <changelog author="schwab@suse.de" date="1681214400">- riscv-atomic.patch: RISC-V: Add support for inlining subword atomic
  operations
- riscv-pthread.patch: Don't add -latomic with -pthread</changelog>
  <changelog author="mliska@suse.cz" date="1681214401">- Add new x86-related intrinsics (amxcomplexintrin.h).</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162.</changelog>
  <changelog author="rguenther@suse.com" date="1682078400">- Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231.
  * fixes compile-time issue reported in [bsc#1210557]
  * GCC 13.1 RC3
- Disable building the rust frontend.</changelog>
  <changelog author="rguenther@suse.com" date="1682596800">- Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256.
  * Includes GCC 13.1 release and first bugfixes
- Update riscv-atomic.patch from the version committed upstream.</changelog>
  <changelog author="rguenther@suse.com" date="1684756800">- Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364.
  * Includes the RISC-V atomic changes
- Remove riscv-atomic.patch and riscv-pthread.patch now included
- Make libstdc++6-devel packages own their directories since they
  can be installed standalone.  [bsc#1211427]</changelog>
  <changelog author="rguenther@suse.com" date="1686657600">- Raise architecture levels for ALP.  [PED-153]
  * Raise POWER architecture baseline to power9.  [PED-2005]
  * Raise x86-64 architecture baseline to x86-64-v2 for ALP.  [PED-252]
  * Delay raising s390x architecture baseline to z14.  [PED-253]</changelog>
  <changelog author="rguenther@suse.com" date="1687953600">- Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489.
- Add gcc13-pr110334.patch to fix missed optimization in Skia
  resulting in Firefox crashes when building with LTO.  [boo#1212101]</changelog>
  <changelog author="rguenther@suse.com" date="1688990400">- Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552
- Remove gcc13-pr110334.patch again as it breaks libreoffice build.</changelog>
  <changelog author="schwab@suse.de" date="1689076800">- Also handle -static-pie in the default-PIE specs</changelog>
  <changelog author="rguenther@suse.com" date="1689854400">- Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597
  * GCC 13.2 RC1
- Add rpmlint filter for SLE12 complaining about invalid licenses.</changelog>
  <changelog author="schwab@suse.de" date="1690977600">- gdcflags.patch: Use substituted GDCFLAGS
- Filter out -Werror=return-type from D compile flags</changelog>
  <changelog author="rguenther@suse.com" date="1691064000">- Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683
  * Includes GCC 13.2 release
  * Includes patch to fix broken testcase in libbacktrace, fixing
    build problems on SLES 12</changelog>
  <changelog author="msuchanek@suse.com" date="1692360000">- Raise Power architecture baseline to Power9 only for ALP (boo#1213915).</changelog>
  <changelog author="rguenther@suse.com" date="1692792000">- Turn cross compiler to s390x to a glibc cross.  [bsc#1214460]</changelog>
  <changelog author="rguenther@suse.com" date="1693224000">- Disable building glibc cross compilers on SLE based code streams,
  the required cross-glibc packages are not available there.
- Disable building avr cross on non-openSUSE code streams since
  avr-libc isn't available there.
- Disable building newlib cross compilers on non-openSUSE code streams
  since newlib isn't available there.
- Fix typo preventing s390x compiler build.
- Raise s390x architecture baseline to z14 for ALP.  [PED-253]
- Turn cross compiler to ppc64le to a glibc cross.</changelog>
  <changelog author="rguenther@suse.com" date="1694520000">- Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831
  * Includes many bugfixes
  * Includes fix to -fstack-protector issues with variable
    length stack allocations on aarch64.  [bsc#1214052] (CVE-2023-4039)</changelog>
</package>
<package pkgid="e4fa25e50d308e8ef222a93bb3f9df60b51da10b35bcd4da1ec627528898fed8" name="git" arch="aarch64">
  <version epoch="0" ver="2.35.3" rel="150300.10.30.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1629547200">- git 2.33.0:
  * "git send-email" learned the "--sendmail-cmd" command line option
    and the "sendemail.sendmailCmd" configuration variable, which is a
    more sensible approach than the current way of repurposing the
    "smtp-server" that is meant to name the server to instead name the
    command to talk to the server.
  * The userdiff pattern for C# learned the token "record".
  * "git rev-list" learns to omit the "commit &lt;object-name&gt;" header
    lines from the output with the `--no-commit-header` option.
  * "git worktree add --lock" learned to record why the worktree is
    locked with a custom message.
  * internal improvements including performance optimizations
  * a number of bug fixes</changelog>
  <changelog author="jsegitz@suse.com" date="1632139200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * git-daemon.service</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1634126400">- git 2.33.1:
  * fix "git pull" and "git rebase -r" various corner cases and bugs
  * "git commit --fixup" now works with "--edit" again.
  * Fix "git send-email" unwanted threading
  * Fix output from "git fast-export" anonymization feature
    showing an annotated tag incorrectly.
  * Fixes for various command output
  * fix "git difftool --dir-diff" mishandling symbolic links
  * Redact sensitive data in the HTTP trace for HTTP/2 requests
  * further bug fixes for various git operations</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634731200">- Add CONFIG parameter to %sysusers_generate_pre
- Remove unneeded SHELL in git-daemon.conf
- Fix sysusers usage in spec file
- Require nogroup group for %pre (bsc#1192023)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637236800">- git 2.34.0:
  * Release notes:
    https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt</changelog>
  <changelog author="dmueller@suse.com" date="1637496000">- fix url</changelog>
  <changelog author="dmueller@suse.com" date="1637928000">- update to 2.34.1 (bsc#1193722):
  * "git grep" looking in a blob that has non-UTF8 payload was
    completely broken when linked with certain versions of PCREv2
    library in the latest release.
  * "git pull" with any strategy when the other side is behind us
    should succeed as it is a no-op, but doesn't.
  * An earlier change in 2.34.0 caused JGit application (that abused
    GIT_EDITOR mechanism when invoking "git config") to get stuck with
    a SIGTTOU signal; it has been reverted.
  * An earlier change that broke .gitignore matching has been reverted.
  * SubmittingPatches document gained a syntactically incorrect mark-up,
    which has been corrected.</changelog>
  <changelog author="dmueller@suse.com" date="1643371200">- update to 2.35.0:
  * "_" is now treated as any other URL-valid characters in an URL when
  matching the per-URL configuration variable names.
  * The color palette used by "git grep" has been updated to match that
  of GNU grep.
  * "git status --porcelain=v2" now show the number of stash entries
  with --show-stash like the normal output does.
  * "git stash" learned the "--staged" option to stash away what has
  been added to the index (and nothing else).
  * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for
  the newly created branch if "git init" is run.
  * Various operating modes of "git reset" have been made to work
  better with the sparse index.
  * "git submodule deinit" for a submodule whose .git metadata
  directory is embedded in its working tree refused to work, until
  the submodule gets converted to use the "absorbed" form where the
  metadata directory is stored in superproject, and a gitfile at the
  top-level of the working tree of the submodule points at it.  The
  command is taught to convert such submodules to the absorbed form
  as needed.
  * The completion script (in contrib/) learns that the "--date"
  option of commands from the "git log" family takes "human" and
  "auto" as valid values.
  * "Zealous diff3" style of merge conflict presentation has been added.
  * The "git log --format=%(describe)" placeholder has been extended to
  allow passing selected command-line options to the underlying "git
  describe" command.
  * "default" and "reset" have been added to our color palette.
  * The cryptographic signing using ssh keys can specify literal keys
  for keytypes whose name do not begin with the "ssh-" prefix by
  using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256").
  * "git fetch" without the "--update-head-ok" option ought to protect
  a checked out branch from getting updated, to prevent the working
  tree that checks it out to go out of sync.  The code was written
  before the use of "git worktree" got widespread, and only checked
  the branch that was checked out in the current worktree, which has
  been updated.
  * "git name-rev" has been tweaked to give output that is shorter and
  easier to understand.
  * "git apply" has been taught to ignore a message without a patch
  with the "--allow-empty" option.  It also learned to honor the
  "--quiet" option given from the command line.
  * The "init" and "set" subcommands in "git sparse-checkout" have been
  unified for a better user experience and performance.
  * Many git commands that deal with working tree files try to remove a
  directory that becomes empty (i.e. "git switch" from a branch that
  has the directory to another branch that does not would attempt
  remove all files in the directory and the directory itself).  This
  drops users into an unfamiliar situation if the command was run in
  a subdirectory that becomes subject to removal due to the command.
  The commands have been taught to keep an empty directory if it is
  the directory they were started in to avoid surprising users.
  * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is
  done to a piece of e-mail without a patch in it.
  * The default merge message prepared by "git merge" records the name
  of the current branch; the name can be overridden with a new option
  to allow users to pretend a merge is made on a different branch.
  * The way "git p4" shows file sizes in its output has been updated to
  use human-readable units.
  * "git -c branch.autosetupmerge=inherit branch new old" makes "new"
  to have the same upstream as the "old" branch, instead of marking
  "old" itself as its upstream.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1643457600">- update to 2.35.1:
  * fix "rebase" and "stash" in a secondary worktree</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645444800">- "Downgrade" git-gui and gitk Recommends to Suggests.</changelog>
  <changelog author="chris@computersalat.de" date="1646913600">- fix deps for SLES 12</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1649764800">- git 2.35.2 (CVE-2022-24765, bsc#1198234):
  * CVE-2022-24765: git may execute commands defined by other users
    from unexpected worktrees</changelog>
  <changelog author="olaf@aepfle.de" date="1649851200">- Require bash in git-daemon because the service file uses it
- Reword git-daemon.service description to get a useful sentence
  in journalctl -b</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1649937600">- git 2.35.3:
  * usability fix-up for CVE-2022-24765 bsc#1198234:
    '*' can be used as the value for the `safe.directory` variable
    to signal that the user considers that any directory is safe.
  * The code that was meant to parse the new `safe.directory`
    configuration variable was not checking what configuration
    variable was being fed to it</changelog>
  <changelog author="danilo.spinella@suse.com" date="1657713600">- Follow up fix for CVE-2022-24765, potential command injection
  via git worktree.
  (CVE-2022-29187, bsc#1201431)
  * fix-CVE-2022-29187.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1666353600">- Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to
  arbitrary heap writes and remote code execution
  (CVE-2022-39260, bsc#1204456)
  fix-CVE-2022-39260.patch
- Fix CVE-2022-39253, dereference issue with symbolic links via
  the `--local` clone mechanism
  (CVE-2022-39253, bsc#1204455)
  fix-CVE-2022-39253.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1673524800">- Fix CVE-2022-41903, heap overflow in `git archive` and
  `git log --format`
  (CVE-2022-41903, bsc#1207033)
  * fix-CVE-2022-41903.patch
- Fix CVE-2022-23521, gitattributes parsing integer overflow
  (CVE-2022-23521, bsc#1207032)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1676289600">- Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked
  into using its local clone optimization even when using a non-local transport
  (CVE-2023-22490, bsc#1208027)
- Fix CVE-2023-23946, a path outside the working tree can be overwritten as the
  user who is running "git apply"
  (CVE-2023-23946, bsc#1208028)
  * fix-CVE-2023-22490-1.patch
  * fix-CVE-2023-22490-2.patch
  * fix-CVE-2023-22490-3.patch
  * fix-CVE-2023-22490-4.patch</changelog>
  <changelog author="psimons@suse.com" date="1682337600">- Apply "CVE-2023-25652.patch" to fix a security vulnerability
  where by feeding a specially crafted input to `git apply
  - -reject`, a path outside the working tree could be overwritten
  with partially controlled contents (corresponding to the rejected
  hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686]
- Apply "CVE-2023-25815.patch" to fix a security vulnerability that
  exists when Git is compiled with runtime prefix support and runs
  without translated messages, then it still used the gettext
  machinery to display messages, which subsequently potentially
  looked for translated messages in unexpected places. This allowed
  for malicious placement of crafted messages. [CVE-2023-25815,
  bsc#1210686]
- Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch",
  "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a
  security vulnerability that occurred when renaming or deleting a
  section from a configuration file, then certain malicious
  configuration values might have been misinterpreted as the
  beginning of a new configuration section, leading to arbitrary
  configuration injection. [CVE-2023-29007, bsc#1210686]</changelog>
  <changelog author="msuchanek@suse.com" date="1695384000">- Downgrade openssh dependency to recommends (bsc#1215533)</changelog>
</package>
<package pkgid="cb31dd7ef558b46dd53d3fb7dd6466fb21f710c0540213ad7ff3ee89afb282ad" name="git" arch="s390x">
  <version epoch="0" ver="2.35.3" rel="150300.10.30.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1629547200">- git 2.33.0:
  * "git send-email" learned the "--sendmail-cmd" command line option
    and the "sendemail.sendmailCmd" configuration variable, which is a
    more sensible approach than the current way of repurposing the
    "smtp-server" that is meant to name the server to instead name the
    command to talk to the server.
  * The userdiff pattern for C# learned the token "record".
  * "git rev-list" learns to omit the "commit &lt;object-name&gt;" header
    lines from the output with the `--no-commit-header` option.
  * "git worktree add --lock" learned to record why the worktree is
    locked with a custom message.
  * internal improvements including performance optimizations
  * a number of bug fixes</changelog>
  <changelog author="jsegitz@suse.com" date="1632139200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * git-daemon.service</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1634126400">- git 2.33.1:
  * fix "git pull" and "git rebase -r" various corner cases and bugs
  * "git commit --fixup" now works with "--edit" again.
  * Fix "git send-email" unwanted threading
  * Fix output from "git fast-export" anonymization feature
    showing an annotated tag incorrectly.
  * Fixes for various command output
  * fix "git difftool --dir-diff" mishandling symbolic links
  * Redact sensitive data in the HTTP trace for HTTP/2 requests
  * further bug fixes for various git operations</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634731200">- Add CONFIG parameter to %sysusers_generate_pre
- Remove unneeded SHELL in git-daemon.conf
- Fix sysusers usage in spec file
- Require nogroup group for %pre (bsc#1192023)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637236800">- git 2.34.0:
  * Release notes:
    https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt</changelog>
  <changelog author="dmueller@suse.com" date="1637496000">- fix url</changelog>
  <changelog author="dmueller@suse.com" date="1637928000">- update to 2.34.1 (bsc#1193722):
  * "git grep" looking in a blob that has non-UTF8 payload was
    completely broken when linked with certain versions of PCREv2
    library in the latest release.
  * "git pull" with any strategy when the other side is behind us
    should succeed as it is a no-op, but doesn't.
  * An earlier change in 2.34.0 caused JGit application (that abused
    GIT_EDITOR mechanism when invoking "git config") to get stuck with
    a SIGTTOU signal; it has been reverted.
  * An earlier change that broke .gitignore matching has been reverted.
  * SubmittingPatches document gained a syntactically incorrect mark-up,
    which has been corrected.</changelog>
  <changelog author="dmueller@suse.com" date="1643371200">- update to 2.35.0:
  * "_" is now treated as any other URL-valid characters in an URL when
  matching the per-URL configuration variable names.
  * The color palette used by "git grep" has been updated to match that
  of GNU grep.
  * "git status --porcelain=v2" now show the number of stash entries
  with --show-stash like the normal output does.
  * "git stash" learned the "--staged" option to stash away what has
  been added to the index (and nothing else).
  * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for
  the newly created branch if "git init" is run.
  * Various operating modes of "git reset" have been made to work
  better with the sparse index.
  * "git submodule deinit" for a submodule whose .git metadata
  directory is embedded in its working tree refused to work, until
  the submodule gets converted to use the "absorbed" form where the
  metadata directory is stored in superproject, and a gitfile at the
  top-level of the working tree of the submodule points at it.  The
  command is taught to convert such submodules to the absorbed form
  as needed.
  * The completion script (in contrib/) learns that the "--date"
  option of commands from the "git log" family takes "human" and
  "auto" as valid values.
  * "Zealous diff3" style of merge conflict presentation has been added.
  * The "git log --format=%(describe)" placeholder has been extended to
  allow passing selected command-line options to the underlying "git
  describe" command.
  * "default" and "reset" have been added to our color palette.
  * The cryptographic signing using ssh keys can specify literal keys
  for keytypes whose name do not begin with the "ssh-" prefix by
  using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256").
  * "git fetch" without the "--update-head-ok" option ought to protect
  a checked out branch from getting updated, to prevent the working
  tree that checks it out to go out of sync.  The code was written
  before the use of "git worktree" got widespread, and only checked
  the branch that was checked out in the current worktree, which has
  been updated.
  * "git name-rev" has been tweaked to give output that is shorter and
  easier to understand.
  * "git apply" has been taught to ignore a message without a patch
  with the "--allow-empty" option.  It also learned to honor the
  "--quiet" option given from the command line.
  * The "init" and "set" subcommands in "git sparse-checkout" have been
  unified for a better user experience and performance.
  * Many git commands that deal with working tree files try to remove a
  directory that becomes empty (i.e. "git switch" from a branch that
  has the directory to another branch that does not would attempt
  remove all files in the directory and the directory itself).  This
  drops users into an unfamiliar situation if the command was run in
  a subdirectory that becomes subject to removal due to the command.
  The commands have been taught to keep an empty directory if it is
  the directory they were started in to avoid surprising users.
  * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is
  done to a piece of e-mail without a patch in it.
  * The default merge message prepared by "git merge" records the name
  of the current branch; the name can be overridden with a new option
  to allow users to pretend a merge is made on a different branch.
  * The way "git p4" shows file sizes in its output has been updated to
  use human-readable units.
  * "git -c branch.autosetupmerge=inherit branch new old" makes "new"
  to have the same upstream as the "old" branch, instead of marking
  "old" itself as its upstream.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1643457600">- update to 2.35.1:
  * fix "rebase" and "stash" in a secondary worktree</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645444800">- "Downgrade" git-gui and gitk Recommends to Suggests.</changelog>
  <changelog author="chris@computersalat.de" date="1646913600">- fix deps for SLES 12</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1649764800">- git 2.35.2 (CVE-2022-24765, bsc#1198234):
  * CVE-2022-24765: git may execute commands defined by other users
    from unexpected worktrees</changelog>
  <changelog author="olaf@aepfle.de" date="1649851200">- Require bash in git-daemon because the service file uses it
- Reword git-daemon.service description to get a useful sentence
  in journalctl -b</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1649937600">- git 2.35.3:
  * usability fix-up for CVE-2022-24765 bsc#1198234:
    '*' can be used as the value for the `safe.directory` variable
    to signal that the user considers that any directory is safe.
  * The code that was meant to parse the new `safe.directory`
    configuration variable was not checking what configuration
    variable was being fed to it</changelog>
  <changelog author="danilo.spinella@suse.com" date="1657713600">- Follow up fix for CVE-2022-24765, potential command injection
  via git worktree.
  (CVE-2022-29187, bsc#1201431)
  * fix-CVE-2022-29187.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1666353600">- Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to
  arbitrary heap writes and remote code execution
  (CVE-2022-39260, bsc#1204456)
  fix-CVE-2022-39260.patch
- Fix CVE-2022-39253, dereference issue with symbolic links via
  the `--local` clone mechanism
  (CVE-2022-39253, bsc#1204455)
  fix-CVE-2022-39253.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1673524800">- Fix CVE-2022-41903, heap overflow in `git archive` and
  `git log --format`
  (CVE-2022-41903, bsc#1207033)
  * fix-CVE-2022-41903.patch
- Fix CVE-2022-23521, gitattributes parsing integer overflow
  (CVE-2022-23521, bsc#1207032)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1676289600">- Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked
  into using its local clone optimization even when using a non-local transport
  (CVE-2023-22490, bsc#1208027)
- Fix CVE-2023-23946, a path outside the working tree can be overwritten as the
  user who is running "git apply"
  (CVE-2023-23946, bsc#1208028)
  * fix-CVE-2023-22490-1.patch
  * fix-CVE-2023-22490-2.patch
  * fix-CVE-2023-22490-3.patch
  * fix-CVE-2023-22490-4.patch</changelog>
  <changelog author="psimons@suse.com" date="1682337600">- Apply "CVE-2023-25652.patch" to fix a security vulnerability
  where by feeding a specially crafted input to `git apply
  - -reject`, a path outside the working tree could be overwritten
  with partially controlled contents (corresponding to the rejected
  hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686]
- Apply "CVE-2023-25815.patch" to fix a security vulnerability that
  exists when Git is compiled with runtime prefix support and runs
  without translated messages, then it still used the gettext
  machinery to display messages, which subsequently potentially
  looked for translated messages in unexpected places. This allowed
  for malicious placement of crafted messages. [CVE-2023-25815,
  bsc#1210686]
- Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch",
  "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a
  security vulnerability that occurred when renaming or deleting a
  section from a configuration file, then certain malicious
  configuration values might have been misinterpreted as the
  beginning of a new configuration section, leading to arbitrary
  configuration injection. [CVE-2023-29007, bsc#1210686]</changelog>
  <changelog author="msuchanek@suse.com" date="1695384000">- Downgrade openssh dependency to recommends (bsc#1215533)</changelog>
</package>
<package pkgid="63a9366e1c09ded162fbbe58bf18fc777cfa41c5a98435809afe2e02edd95ef1" name="git" arch="src">
  <version epoch="0" ver="2.35.3" rel="150300.10.30.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1629547200">- git 2.33.0:
  * "git send-email" learned the "--sendmail-cmd" command line option
    and the "sendemail.sendmailCmd" configuration variable, which is a
    more sensible approach than the current way of repurposing the
    "smtp-server" that is meant to name the server to instead name the
    command to talk to the server.
  * The userdiff pattern for C# learned the token "record".
  * "git rev-list" learns to omit the "commit &lt;object-name&gt;" header
    lines from the output with the `--no-commit-header` option.
  * "git worktree add --lock" learned to record why the worktree is
    locked with a custom message.
  * internal improvements including performance optimizations
  * a number of bug fixes</changelog>
  <changelog author="jsegitz@suse.com" date="1632139200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * git-daemon.service</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1634126400">- git 2.33.1:
  * fix "git pull" and "git rebase -r" various corner cases and bugs
  * "git commit --fixup" now works with "--edit" again.
  * Fix "git send-email" unwanted threading
  * Fix output from "git fast-export" anonymization feature
    showing an annotated tag incorrectly.
  * Fixes for various command output
  * fix "git difftool --dir-diff" mishandling symbolic links
  * Redact sensitive data in the HTTP trace for HTTP/2 requests
  * further bug fixes for various git operations</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634731200">- Add CONFIG parameter to %sysusers_generate_pre
- Remove unneeded SHELL in git-daemon.conf
- Fix sysusers usage in spec file
- Require nogroup group for %pre (bsc#1192023)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637236800">- git 2.34.0:
  * Release notes:
    https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt</changelog>
  <changelog author="dmueller@suse.com" date="1637496000">- fix url</changelog>
  <changelog author="dmueller@suse.com" date="1637928000">- update to 2.34.1 (bsc#1193722):
  * "git grep" looking in a blob that has non-UTF8 payload was
    completely broken when linked with certain versions of PCREv2
    library in the latest release.
  * "git pull" with any strategy when the other side is behind us
    should succeed as it is a no-op, but doesn't.
  * An earlier change in 2.34.0 caused JGit application (that abused
    GIT_EDITOR mechanism when invoking "git config") to get stuck with
    a SIGTTOU signal; it has been reverted.
  * An earlier change that broke .gitignore matching has been reverted.
  * SubmittingPatches document gained a syntactically incorrect mark-up,
    which has been corrected.</changelog>
  <changelog author="dmueller@suse.com" date="1643371200">- update to 2.35.0:
  * "_" is now treated as any other URL-valid characters in an URL when
  matching the per-URL configuration variable names.
  * The color palette used by "git grep" has been updated to match that
  of GNU grep.
  * "git status --porcelain=v2" now show the number of stash entries
  with --show-stash like the normal output does.
  * "git stash" learned the "--staged" option to stash away what has
  been added to the index (and nothing else).
  * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for
  the newly created branch if "git init" is run.
  * Various operating modes of "git reset" have been made to work
  better with the sparse index.
  * "git submodule deinit" for a submodule whose .git metadata
  directory is embedded in its working tree refused to work, until
  the submodule gets converted to use the "absorbed" form where the
  metadata directory is stored in superproject, and a gitfile at the
  top-level of the working tree of the submodule points at it.  The
  command is taught to convert such submodules to the absorbed form
  as needed.
  * The completion script (in contrib/) learns that the "--date"
  option of commands from the "git log" family takes "human" and
  "auto" as valid values.
  * "Zealous diff3" style of merge conflict presentation has been added.
  * The "git log --format=%(describe)" placeholder has been extended to
  allow passing selected command-line options to the underlying "git
  describe" command.
  * "default" and "reset" have been added to our color palette.
  * The cryptographic signing using ssh keys can specify literal keys
  for keytypes whose name do not begin with the "ssh-" prefix by
  using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256").
  * "git fetch" without the "--update-head-ok" option ought to protect
  a checked out branch from getting updated, to prevent the working
  tree that checks it out to go out of sync.  The code was written
  before the use of "git worktree" got widespread, and only checked
  the branch that was checked out in the current worktree, which has
  been updated.
  * "git name-rev" has been tweaked to give output that is shorter and
  easier to understand.
  * "git apply" has been taught to ignore a message without a patch
  with the "--allow-empty" option.  It also learned to honor the
  "--quiet" option given from the command line.
  * The "init" and "set" subcommands in "git sparse-checkout" have been
  unified for a better user experience and performance.
  * Many git commands that deal with working tree files try to remove a
  directory that becomes empty (i.e. "git switch" from a branch that
  has the directory to another branch that does not would attempt
  remove all files in the directory and the directory itself).  This
  drops users into an unfamiliar situation if the command was run in
  a subdirectory that becomes subject to removal due to the command.
  The commands have been taught to keep an empty directory if it is
  the directory they were started in to avoid surprising users.
  * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is
  done to a piece of e-mail without a patch in it.
  * The default merge message prepared by "git merge" records the name
  of the current branch; the name can be overridden with a new option
  to allow users to pretend a merge is made on a different branch.
  * The way "git p4" shows file sizes in its output has been updated to
  use human-readable units.
  * "git -c branch.autosetupmerge=inherit branch new old" makes "new"
  to have the same upstream as the "old" branch, instead of marking
  "old" itself as its upstream.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1643457600">- update to 2.35.1:
  * fix "rebase" and "stash" in a secondary worktree</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645444800">- "Downgrade" git-gui and gitk Recommends to Suggests.</changelog>
  <changelog author="chris@computersalat.de" date="1646913600">- fix deps for SLES 12</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1649764800">- git 2.35.2 (CVE-2022-24765, bsc#1198234):
  * CVE-2022-24765: git may execute commands defined by other users
    from unexpected worktrees</changelog>
  <changelog author="olaf@aepfle.de" date="1649851200">- Require bash in git-daemon because the service file uses it
- Reword git-daemon.service description to get a useful sentence
  in journalctl -b</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1649937600">- git 2.35.3:
  * usability fix-up for CVE-2022-24765 bsc#1198234:
    '*' can be used as the value for the `safe.directory` variable
    to signal that the user considers that any directory is safe.
  * The code that was meant to parse the new `safe.directory`
    configuration variable was not checking what configuration
    variable was being fed to it</changelog>
  <changelog author="danilo.spinella@suse.com" date="1657713600">- Follow up fix for CVE-2022-24765, potential command injection
  via git worktree.
  (CVE-2022-29187, bsc#1201431)
  * fix-CVE-2022-29187.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1666353600">- Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to
  arbitrary heap writes and remote code execution
  (CVE-2022-39260, bsc#1204456)
  fix-CVE-2022-39260.patch
- Fix CVE-2022-39253, dereference issue with symbolic links via
  the `--local` clone mechanism
  (CVE-2022-39253, bsc#1204455)
  fix-CVE-2022-39253.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1673524800">- Fix CVE-2022-41903, heap overflow in `git archive` and
  `git log --format`
  (CVE-2022-41903, bsc#1207033)
  * fix-CVE-2022-41903.patch
- Fix CVE-2022-23521, gitattributes parsing integer overflow
  (CVE-2022-23521, bsc#1207032)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1676289600">- Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked
  into using its local clone optimization even when using a non-local transport
  (CVE-2023-22490, bsc#1208027)
- Fix CVE-2023-23946, a path outside the working tree can be overwritten as the
  user who is running "git apply"
  (CVE-2023-23946, bsc#1208028)
  * fix-CVE-2023-22490-1.patch
  * fix-CVE-2023-22490-2.patch
  * fix-CVE-2023-22490-3.patch
  * fix-CVE-2023-22490-4.patch</changelog>
  <changelog author="psimons@suse.com" date="1682337600">- Apply "CVE-2023-25652.patch" to fix a security vulnerability
  where by feeding a specially crafted input to `git apply
  - -reject`, a path outside the working tree could be overwritten
  with partially controlled contents (corresponding to the rejected
  hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686]
- Apply "CVE-2023-25815.patch" to fix a security vulnerability that
  exists when Git is compiled with runtime prefix support and runs
  without translated messages, then it still used the gettext
  machinery to display messages, which subsequently potentially
  looked for translated messages in unexpected places. This allowed
  for malicious placement of crafted messages. [CVE-2023-25815,
  bsc#1210686]
- Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch",
  "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a
  security vulnerability that occurred when renaming or deleting a
  section from a configuration file, then certain malicious
  configuration values might have been misinterpreted as the
  beginning of a new configuration section, leading to arbitrary
  configuration injection. [CVE-2023-29007, bsc#1210686]</changelog>
  <changelog author="msuchanek@suse.com" date="1695384000">- Downgrade openssh dependency to recommends (bsc#1215533)</changelog>
</package>
<package pkgid="8a954af8f97bcb82a244850356f8990302006240c216f82ca1414edae4f91b3b" name="git" arch="x86_64">
  <version epoch="0" ver="2.35.3" rel="150300.10.30.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1629547200">- git 2.33.0:
  * "git send-email" learned the "--sendmail-cmd" command line option
    and the "sendemail.sendmailCmd" configuration variable, which is a
    more sensible approach than the current way of repurposing the
    "smtp-server" that is meant to name the server to instead name the
    command to talk to the server.
  * The userdiff pattern for C# learned the token "record".
  * "git rev-list" learns to omit the "commit &lt;object-name&gt;" header
    lines from the output with the `--no-commit-header` option.
  * "git worktree add --lock" learned to record why the worktree is
    locked with a custom message.
  * internal improvements including performance optimizations
  * a number of bug fixes</changelog>
  <changelog author="jsegitz@suse.com" date="1632139200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * git-daemon.service</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1634126400">- git 2.33.1:
  * fix "git pull" and "git rebase -r" various corner cases and bugs
  * "git commit --fixup" now works with "--edit" again.
  * Fix "git send-email" unwanted threading
  * Fix output from "git fast-export" anonymization feature
    showing an annotated tag incorrectly.
  * Fixes for various command output
  * fix "git difftool --dir-diff" mishandling symbolic links
  * Redact sensitive data in the HTTP trace for HTTP/2 requests
  * further bug fixes for various git operations</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634731200">- Add CONFIG parameter to %sysusers_generate_pre
- Remove unneeded SHELL in git-daemon.conf
- Fix sysusers usage in spec file
- Require nogroup group for %pre (bsc#1192023)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637236800">- git 2.34.0:
  * Release notes:
    https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt</changelog>
  <changelog author="dmueller@suse.com" date="1637496000">- fix url</changelog>
  <changelog author="dmueller@suse.com" date="1637928000">- update to 2.34.1 (bsc#1193722):
  * "git grep" looking in a blob that has non-UTF8 payload was
    completely broken when linked with certain versions of PCREv2
    library in the latest release.
  * "git pull" with any strategy when the other side is behind us
    should succeed as it is a no-op, but doesn't.
  * An earlier change in 2.34.0 caused JGit application (that abused
    GIT_EDITOR mechanism when invoking "git config") to get stuck with
    a SIGTTOU signal; it has been reverted.
  * An earlier change that broke .gitignore matching has been reverted.
  * SubmittingPatches document gained a syntactically incorrect mark-up,
    which has been corrected.</changelog>
  <changelog author="dmueller@suse.com" date="1643371200">- update to 2.35.0:
  * "_" is now treated as any other URL-valid characters in an URL when
  matching the per-URL configuration variable names.
  * The color palette used by "git grep" has been updated to match that
  of GNU grep.
  * "git status --porcelain=v2" now show the number of stash entries
  with --show-stash like the normal output does.
  * "git stash" learned the "--staged" option to stash away what has
  been added to the index (and nothing else).
  * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for
  the newly created branch if "git init" is run.
  * Various operating modes of "git reset" have been made to work
  better with the sparse index.
  * "git submodule deinit" for a submodule whose .git metadata
  directory is embedded in its working tree refused to work, until
  the submodule gets converted to use the "absorbed" form where the
  metadata directory is stored in superproject, and a gitfile at the
  top-level of the working tree of the submodule points at it.  The
  command is taught to convert such submodules to the absorbed form
  as needed.
  * The completion script (in contrib/) learns that the "--date"
  option of commands from the "git log" family takes "human" and
  "auto" as valid values.
  * "Zealous diff3" style of merge conflict presentation has been added.
  * The "git log --format=%(describe)" placeholder has been extended to
  allow passing selected command-line options to the underlying "git
  describe" command.
  * "default" and "reset" have been added to our color palette.
  * The cryptographic signing using ssh keys can specify literal keys
  for keytypes whose name do not begin with the "ssh-" prefix by
  using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256").
  * "git fetch" without the "--update-head-ok" option ought to protect
  a checked out branch from getting updated, to prevent the working
  tree that checks it out to go out of sync.  The code was written
  before the use of "git worktree" got widespread, and only checked
  the branch that was checked out in the current worktree, which has
  been updated.
  * "git name-rev" has been tweaked to give output that is shorter and
  easier to understand.
  * "git apply" has been taught to ignore a message without a patch
  with the "--allow-empty" option.  It also learned to honor the
  "--quiet" option given from the command line.
  * The "init" and "set" subcommands in "git sparse-checkout" have been
  unified for a better user experience and performance.
  * Many git commands that deal with working tree files try to remove a
  directory that becomes empty (i.e. "git switch" from a branch that
  has the directory to another branch that does not would attempt
  remove all files in the directory and the directory itself).  This
  drops users into an unfamiliar situation if the command was run in
  a subdirectory that becomes subject to removal due to the command.
  The commands have been taught to keep an empty directory if it is
  the directory they were started in to avoid surprising users.
  * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is
  done to a piece of e-mail without a patch in it.
  * The default merge message prepared by "git merge" records the name
  of the current branch; the name can be overridden with a new option
  to allow users to pretend a merge is made on a different branch.
  * The way "git p4" shows file sizes in its output has been updated to
  use human-readable units.
  * "git -c branch.autosetupmerge=inherit branch new old" makes "new"
  to have the same upstream as the "old" branch, instead of marking
  "old" itself as its upstream.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1643457600">- update to 2.35.1:
  * fix "rebase" and "stash" in a secondary worktree</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645444800">- "Downgrade" git-gui and gitk Recommends to Suggests.</changelog>
  <changelog author="chris@computersalat.de" date="1646913600">- fix deps for SLES 12</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1649764800">- git 2.35.2 (CVE-2022-24765, bsc#1198234):
  * CVE-2022-24765: git may execute commands defined by other users
    from unexpected worktrees</changelog>
  <changelog author="olaf@aepfle.de" date="1649851200">- Require bash in git-daemon because the service file uses it
- Reword git-daemon.service description to get a useful sentence
  in journalctl -b</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1649937600">- git 2.35.3:
  * usability fix-up for CVE-2022-24765 bsc#1198234:
    '*' can be used as the value for the `safe.directory` variable
    to signal that the user considers that any directory is safe.
  * The code that was meant to parse the new `safe.directory`
    configuration variable was not checking what configuration
    variable was being fed to it</changelog>
  <changelog author="danilo.spinella@suse.com" date="1657713600">- Follow up fix for CVE-2022-24765, potential command injection
  via git worktree.
  (CVE-2022-29187, bsc#1201431)
  * fix-CVE-2022-29187.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1666353600">- Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to
  arbitrary heap writes and remote code execution
  (CVE-2022-39260, bsc#1204456)
  fix-CVE-2022-39260.patch
- Fix CVE-2022-39253, dereference issue with symbolic links via
  the `--local` clone mechanism
  (CVE-2022-39253, bsc#1204455)
  fix-CVE-2022-39253.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1673524800">- Fix CVE-2022-41903, heap overflow in `git archive` and
  `git log --format`
  (CVE-2022-41903, bsc#1207033)
  * fix-CVE-2022-41903.patch
- Fix CVE-2022-23521, gitattributes parsing integer overflow
  (CVE-2022-23521, bsc#1207032)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1676289600">- Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked
  into using its local clone optimization even when using a non-local transport
  (CVE-2023-22490, bsc#1208027)
- Fix CVE-2023-23946, a path outside the working tree can be overwritten as the
  user who is running "git apply"
  (CVE-2023-23946, bsc#1208028)
  * fix-CVE-2023-22490-1.patch
  * fix-CVE-2023-22490-2.patch
  * fix-CVE-2023-22490-3.patch
  * fix-CVE-2023-22490-4.patch</changelog>
  <changelog author="psimons@suse.com" date="1682337600">- Apply "CVE-2023-25652.patch" to fix a security vulnerability
  where by feeding a specially crafted input to `git apply
  - -reject`, a path outside the working tree could be overwritten
  with partially controlled contents (corresponding to the rejected
  hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686]
- Apply "CVE-2023-25815.patch" to fix a security vulnerability that
  exists when Git is compiled with runtime prefix support and runs
  without translated messages, then it still used the gettext
  machinery to display messages, which subsequently potentially
  looked for translated messages in unexpected places. This allowed
  for malicious placement of crafted messages. [CVE-2023-25815,
  bsc#1210686]
- Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch",
  "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a
  security vulnerability that occurred when renaming or deleting a
  section from a configuration file, then certain malicious
  configuration values might have been misinterpreted as the
  beginning of a new configuration section, leading to arbitrary
  configuration injection. [CVE-2023-29007, bsc#1210686]</changelog>
  <changelog author="msuchanek@suse.com" date="1695384000">- Downgrade openssh dependency to recommends (bsc#1215533)</changelog>
</package>
<package pkgid="2a7df55772f4cd629a82e3ad1090fd36c8c3a7e354359ee6af6e2a6a762bebd7" name="git-core" arch="aarch64">
  <version epoch="0" ver="2.35.3" rel="150300.10.30.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1629547200">- git 2.33.0:
  * "git send-email" learned the "--sendmail-cmd" command line option
    and the "sendemail.sendmailCmd" configuration variable, which is a
    more sensible approach than the current way of repurposing the
    "smtp-server" that is meant to name the server to instead name the
    command to talk to the server.
  * The userdiff pattern for C# learned the token "record".
  * "git rev-list" learns to omit the "commit &lt;object-name&gt;" header
    lines from the output with the `--no-commit-header` option.
  * "git worktree add --lock" learned to record why the worktree is
    locked with a custom message.
  * internal improvements including performance optimizations
  * a number of bug fixes</changelog>
  <changelog author="jsegitz@suse.com" date="1632139200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * git-daemon.service</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1634126400">- git 2.33.1:
  * fix "git pull" and "git rebase -r" various corner cases and bugs
  * "git commit --fixup" now works with "--edit" again.
  * Fix "git send-email" unwanted threading
  * Fix output from "git fast-export" anonymization feature
    showing an annotated tag incorrectly.
  * Fixes for various command output
  * fix "git difftool --dir-diff" mishandling symbolic links
  * Redact sensitive data in the HTTP trace for HTTP/2 requests
  * further bug fixes for various git operations</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634731200">- Add CONFIG parameter to %sysusers_generate_pre
- Remove unneeded SHELL in git-daemon.conf
- Fix sysusers usage in spec file
- Require nogroup group for %pre (bsc#1192023)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637236800">- git 2.34.0:
  * Release notes:
    https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt</changelog>
  <changelog author="dmueller@suse.com" date="1637496000">- fix url</changelog>
  <changelog author="dmueller@suse.com" date="1637928000">- update to 2.34.1 (bsc#1193722):
  * "git grep" looking in a blob that has non-UTF8 payload was
    completely broken when linked with certain versions of PCREv2
    library in the latest release.
  * "git pull" with any strategy when the other side is behind us
    should succeed as it is a no-op, but doesn't.
  * An earlier change in 2.34.0 caused JGit application (that abused
    GIT_EDITOR mechanism when invoking "git config") to get stuck with
    a SIGTTOU signal; it has been reverted.
  * An earlier change that broke .gitignore matching has been reverted.
  * SubmittingPatches document gained a syntactically incorrect mark-up,
    which has been corrected.</changelog>
  <changelog author="dmueller@suse.com" date="1643371200">- update to 2.35.0:
  * "_" is now treated as any other URL-valid characters in an URL when
  matching the per-URL configuration variable names.
  * The color palette used by "git grep" has been updated to match that
  of GNU grep.
  * "git status --porcelain=v2" now show the number of stash entries
  with --show-stash like the normal output does.
  * "git stash" learned the "--staged" option to stash away what has
  been added to the index (and nothing else).
  * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for
  the newly created branch if "git init" is run.
  * Various operating modes of "git reset" have been made to work
  better with the sparse index.
  * "git submodule deinit" for a submodule whose .git metadata
  directory is embedded in its working tree refused to work, until
  the submodule gets converted to use the "absorbed" form where the
  metadata directory is stored in superproject, and a gitfile at the
  top-level of the working tree of the submodule points at it.  The
  command is taught to convert such submodules to the absorbed form
  as needed.
  * The completion script (in contrib/) learns that the "--date"
  option of commands from the "git log" family takes "human" and
  "auto" as valid values.
  * "Zealous diff3" style of merge conflict presentation has been added.
  * The "git log --format=%(describe)" placeholder has been extended to
  allow passing selected command-line options to the underlying "git
  describe" command.
  * "default" and "reset" have been added to our color palette.
  * The cryptographic signing using ssh keys can specify literal keys
  for keytypes whose name do not begin with the "ssh-" prefix by
  using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256").
  * "git fetch" without the "--update-head-ok" option ought to protect
  a checked out branch from getting updated, to prevent the working
  tree that checks it out to go out of sync.  The code was written
  before the use of "git worktree" got widespread, and only checked
  the branch that was checked out in the current worktree, which has
  been updated.
  * "git name-rev" has been tweaked to give output that is shorter and
  easier to understand.
  * "git apply" has been taught to ignore a message without a patch
  with the "--allow-empty" option.  It also learned to honor the
  "--quiet" option given from the command line.
  * The "init" and "set" subcommands in "git sparse-checkout" have been
  unified for a better user experience and performance.
  * Many git commands that deal with working tree files try to remove a
  directory that becomes empty (i.e. "git switch" from a branch that
  has the directory to another branch that does not would attempt
  remove all files in the directory and the directory itself).  This
  drops users into an unfamiliar situation if the command was run in
  a subdirectory that becomes subject to removal due to the command.
  The commands have been taught to keep an empty directory if it is
  the directory they were started in to avoid surprising users.
  * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is
  done to a piece of e-mail without a patch in it.
  * The default merge message prepared by "git merge" records the name
  of the current branch; the name can be overridden with a new option
  to allow users to pretend a merge is made on a different branch.
  * The way "git p4" shows file sizes in its output has been updated to
  use human-readable units.
  * "git -c branch.autosetupmerge=inherit branch new old" makes "new"
  to have the same upstream as the "old" branch, instead of marking
  "old" itself as its upstream.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1643457600">- update to 2.35.1:
  * fix "rebase" and "stash" in a secondary worktree</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645444800">- "Downgrade" git-gui and gitk Recommends to Suggests.</changelog>
  <changelog author="chris@computersalat.de" date="1646913600">- fix deps for SLES 12</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1649764800">- git 2.35.2 (CVE-2022-24765, bsc#1198234):
  * CVE-2022-24765: git may execute commands defined by other users
    from unexpected worktrees</changelog>
  <changelog author="olaf@aepfle.de" date="1649851200">- Require bash in git-daemon because the service file uses it
- Reword git-daemon.service description to get a useful sentence
  in journalctl -b</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1649937600">- git 2.35.3:
  * usability fix-up for CVE-2022-24765 bsc#1198234:
    '*' can be used as the value for the `safe.directory` variable
    to signal that the user considers that any directory is safe.
  * The code that was meant to parse the new `safe.directory`
    configuration variable was not checking what configuration
    variable was being fed to it</changelog>
  <changelog author="danilo.spinella@suse.com" date="1657713600">- Follow up fix for CVE-2022-24765, potential command injection
  via git worktree.
  (CVE-2022-29187, bsc#1201431)
  * fix-CVE-2022-29187.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1666353600">- Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to
  arbitrary heap writes and remote code execution
  (CVE-2022-39260, bsc#1204456)
  fix-CVE-2022-39260.patch
- Fix CVE-2022-39253, dereference issue with symbolic links via
  the `--local` clone mechanism
  (CVE-2022-39253, bsc#1204455)
  fix-CVE-2022-39253.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1673524800">- Fix CVE-2022-41903, heap overflow in `git archive` and
  `git log --format`
  (CVE-2022-41903, bsc#1207033)
  * fix-CVE-2022-41903.patch
- Fix CVE-2022-23521, gitattributes parsing integer overflow
  (CVE-2022-23521, bsc#1207032)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1676289600">- Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked
  into using its local clone optimization even when using a non-local transport
  (CVE-2023-22490, bsc#1208027)
- Fix CVE-2023-23946, a path outside the working tree can be overwritten as the
  user who is running "git apply"
  (CVE-2023-23946, bsc#1208028)
  * fix-CVE-2023-22490-1.patch
  * fix-CVE-2023-22490-2.patch
  * fix-CVE-2023-22490-3.patch
  * fix-CVE-2023-22490-4.patch</changelog>
  <changelog author="psimons@suse.com" date="1682337600">- Apply "CVE-2023-25652.patch" to fix a security vulnerability
  where by feeding a specially crafted input to `git apply
  - -reject`, a path outside the working tree could be overwritten
  with partially controlled contents (corresponding to the rejected
  hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686]
- Apply "CVE-2023-25815.patch" to fix a security vulnerability that
  exists when Git is compiled with runtime prefix support and runs
  without translated messages, then it still used the gettext
  machinery to display messages, which subsequently potentially
  looked for translated messages in unexpected places. This allowed
  for malicious placement of crafted messages. [CVE-2023-25815,
  bsc#1210686]
- Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch",
  "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a
  security vulnerability that occurred when renaming or deleting a
  section from a configuration file, then certain malicious
  configuration values might have been misinterpreted as the
  beginning of a new configuration section, leading to arbitrary
  configuration injection. [CVE-2023-29007, bsc#1210686]</changelog>
  <changelog author="msuchanek@suse.com" date="1695384000">- Downgrade openssh dependency to recommends (bsc#1215533)</changelog>
</package>
<package pkgid="30e26fd086cbd42c7c011a8cac04bc044d1e375c06d3e23f08fa7a46ebbab567" name="git-core" arch="s390x">
  <version epoch="0" ver="2.35.3" rel="150300.10.30.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1629547200">- git 2.33.0:
  * "git send-email" learned the "--sendmail-cmd" command line option
    and the "sendemail.sendmailCmd" configuration variable, which is a
    more sensible approach than the current way of repurposing the
    "smtp-server" that is meant to name the server to instead name the
    command to talk to the server.
  * The userdiff pattern for C# learned the token "record".
  * "git rev-list" learns to omit the "commit &lt;object-name&gt;" header
    lines from the output with the `--no-commit-header` option.
  * "git worktree add --lock" learned to record why the worktree is
    locked with a custom message.
  * internal improvements including performance optimizations
  * a number of bug fixes</changelog>
  <changelog author="jsegitz@suse.com" date="1632139200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * git-daemon.service</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1634126400">- git 2.33.1:
  * fix "git pull" and "git rebase -r" various corner cases and bugs
  * "git commit --fixup" now works with "--edit" again.
  * Fix "git send-email" unwanted threading
  * Fix output from "git fast-export" anonymization feature
    showing an annotated tag incorrectly.
  * Fixes for various command output
  * fix "git difftool --dir-diff" mishandling symbolic links
  * Redact sensitive data in the HTTP trace for HTTP/2 requests
  * further bug fixes for various git operations</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634731200">- Add CONFIG parameter to %sysusers_generate_pre
- Remove unneeded SHELL in git-daemon.conf
- Fix sysusers usage in spec file
- Require nogroup group for %pre (bsc#1192023)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637236800">- git 2.34.0:
  * Release notes:
    https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt</changelog>
  <changelog author="dmueller@suse.com" date="1637496000">- fix url</changelog>
  <changelog author="dmueller@suse.com" date="1637928000">- update to 2.34.1 (bsc#1193722):
  * "git grep" looking in a blob that has non-UTF8 payload was
    completely broken when linked with certain versions of PCREv2
    library in the latest release.
  * "git pull" with any strategy when the other side is behind us
    should succeed as it is a no-op, but doesn't.
  * An earlier change in 2.34.0 caused JGit application (that abused
    GIT_EDITOR mechanism when invoking "git config") to get stuck with
    a SIGTTOU signal; it has been reverted.
  * An earlier change that broke .gitignore matching has been reverted.
  * SubmittingPatches document gained a syntactically incorrect mark-up,
    which has been corrected.</changelog>
  <changelog author="dmueller@suse.com" date="1643371200">- update to 2.35.0:
  * "_" is now treated as any other URL-valid characters in an URL when
  matching the per-URL configuration variable names.
  * The color palette used by "git grep" has been updated to match that
  of GNU grep.
  * "git status --porcelain=v2" now show the number of stash entries
  with --show-stash like the normal output does.
  * "git stash" learned the "--staged" option to stash away what has
  been added to the index (and nothing else).
  * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for
  the newly created branch if "git init" is run.
  * Various operating modes of "git reset" have been made to work
  better with the sparse index.
  * "git submodule deinit" for a submodule whose .git metadata
  directory is embedded in its working tree refused to work, until
  the submodule gets converted to use the "absorbed" form where the
  metadata directory is stored in superproject, and a gitfile at the
  top-level of the working tree of the submodule points at it.  The
  command is taught to convert such submodules to the absorbed form
  as needed.
  * The completion script (in contrib/) learns that the "--date"
  option of commands from the "git log" family takes "human" and
  "auto" as valid values.
  * "Zealous diff3" style of merge conflict presentation has been added.
  * The "git log --format=%(describe)" placeholder has been extended to
  allow passing selected command-line options to the underlying "git
  describe" command.
  * "default" and "reset" have been added to our color palette.
  * The cryptographic signing using ssh keys can specify literal keys
  for keytypes whose name do not begin with the "ssh-" prefix by
  using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256").
  * "git fetch" without the "--update-head-ok" option ought to protect
  a checked out branch from getting updated, to prevent the working
  tree that checks it out to go out of sync.  The code was written
  before the use of "git worktree" got widespread, and only checked
  the branch that was checked out in the current worktree, which has
  been updated.
  * "git name-rev" has been tweaked to give output that is shorter and
  easier to understand.
  * "git apply" has been taught to ignore a message without a patch
  with the "--allow-empty" option.  It also learned to honor the
  "--quiet" option given from the command line.
  * The "init" and "set" subcommands in "git sparse-checkout" have been
  unified for a better user experience and performance.
  * Many git commands that deal with working tree files try to remove a
  directory that becomes empty (i.e. "git switch" from a branch that
  has the directory to another branch that does not would attempt
  remove all files in the directory and the directory itself).  This
  drops users into an unfamiliar situation if the command was run in
  a subdirectory that becomes subject to removal due to the command.
  The commands have been taught to keep an empty directory if it is
  the directory they were started in to avoid surprising users.
  * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is
  done to a piece of e-mail without a patch in it.
  * The default merge message prepared by "git merge" records the name
  of the current branch; the name can be overridden with a new option
  to allow users to pretend a merge is made on a different branch.
  * The way "git p4" shows file sizes in its output has been updated to
  use human-readable units.
  * "git -c branch.autosetupmerge=inherit branch new old" makes "new"
  to have the same upstream as the "old" branch, instead of marking
  "old" itself as its upstream.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1643457600">- update to 2.35.1:
  * fix "rebase" and "stash" in a secondary worktree</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645444800">- "Downgrade" git-gui and gitk Recommends to Suggests.</changelog>
  <changelog author="chris@computersalat.de" date="1646913600">- fix deps for SLES 12</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1649764800">- git 2.35.2 (CVE-2022-24765, bsc#1198234):
  * CVE-2022-24765: git may execute commands defined by other users
    from unexpected worktrees</changelog>
  <changelog author="olaf@aepfle.de" date="1649851200">- Require bash in git-daemon because the service file uses it
- Reword git-daemon.service description to get a useful sentence
  in journalctl -b</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1649937600">- git 2.35.3:
  * usability fix-up for CVE-2022-24765 bsc#1198234:
    '*' can be used as the value for the `safe.directory` variable
    to signal that the user considers that any directory is safe.
  * The code that was meant to parse the new `safe.directory`
    configuration variable was not checking what configuration
    variable was being fed to it</changelog>
  <changelog author="danilo.spinella@suse.com" date="1657713600">- Follow up fix for CVE-2022-24765, potential command injection
  via git worktree.
  (CVE-2022-29187, bsc#1201431)
  * fix-CVE-2022-29187.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1666353600">- Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to
  arbitrary heap writes and remote code execution
  (CVE-2022-39260, bsc#1204456)
  fix-CVE-2022-39260.patch
- Fix CVE-2022-39253, dereference issue with symbolic links via
  the `--local` clone mechanism
  (CVE-2022-39253, bsc#1204455)
  fix-CVE-2022-39253.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1673524800">- Fix CVE-2022-41903, heap overflow in `git archive` and
  `git log --format`
  (CVE-2022-41903, bsc#1207033)
  * fix-CVE-2022-41903.patch
- Fix CVE-2022-23521, gitattributes parsing integer overflow
  (CVE-2022-23521, bsc#1207032)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1676289600">- Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked
  into using its local clone optimization even when using a non-local transport
  (CVE-2023-22490, bsc#1208027)
- Fix CVE-2023-23946, a path outside the working tree can be overwritten as the
  user who is running "git apply"
  (CVE-2023-23946, bsc#1208028)
  * fix-CVE-2023-22490-1.patch
  * fix-CVE-2023-22490-2.patch
  * fix-CVE-2023-22490-3.patch
  * fix-CVE-2023-22490-4.patch</changelog>
  <changelog author="psimons@suse.com" date="1682337600">- Apply "CVE-2023-25652.patch" to fix a security vulnerability
  where by feeding a specially crafted input to `git apply
  - -reject`, a path outside the working tree could be overwritten
  with partially controlled contents (corresponding to the rejected
  hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686]
- Apply "CVE-2023-25815.patch" to fix a security vulnerability that
  exists when Git is compiled with runtime prefix support and runs
  without translated messages, then it still used the gettext
  machinery to display messages, which subsequently potentially
  looked for translated messages in unexpected places. This allowed
  for malicious placement of crafted messages. [CVE-2023-25815,
  bsc#1210686]
- Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch",
  "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a
  security vulnerability that occurred when renaming or deleting a
  section from a configuration file, then certain malicious
  configuration values might have been misinterpreted as the
  beginning of a new configuration section, leading to arbitrary
  configuration injection. [CVE-2023-29007, bsc#1210686]</changelog>
  <changelog author="msuchanek@suse.com" date="1695384000">- Downgrade openssh dependency to recommends (bsc#1215533)</changelog>
</package>
<package pkgid="06c12a745a2ff425e27bc8dbabb28a311535631e3b711c4299a9bc0942f5f6ad" name="git-core" arch="x86_64">
  <version epoch="0" ver="2.35.3" rel="150300.10.30.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1629547200">- git 2.33.0:
  * "git send-email" learned the "--sendmail-cmd" command line option
    and the "sendemail.sendmailCmd" configuration variable, which is a
    more sensible approach than the current way of repurposing the
    "smtp-server" that is meant to name the server to instead name the
    command to talk to the server.
  * The userdiff pattern for C# learned the token "record".
  * "git rev-list" learns to omit the "commit &lt;object-name&gt;" header
    lines from the output with the `--no-commit-header` option.
  * "git worktree add --lock" learned to record why the worktree is
    locked with a custom message.
  * internal improvements including performance optimizations
  * a number of bug fixes</changelog>
  <changelog author="jsegitz@suse.com" date="1632139200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * git-daemon.service</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1634126400">- git 2.33.1:
  * fix "git pull" and "git rebase -r" various corner cases and bugs
  * "git commit --fixup" now works with "--edit" again.
  * Fix "git send-email" unwanted threading
  * Fix output from "git fast-export" anonymization feature
    showing an annotated tag incorrectly.
  * Fixes for various command output
  * fix "git difftool --dir-diff" mishandling symbolic links
  * Redact sensitive data in the HTTP trace for HTTP/2 requests
  * further bug fixes for various git operations</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634731200">- Add CONFIG parameter to %sysusers_generate_pre
- Remove unneeded SHELL in git-daemon.conf
- Fix sysusers usage in spec file
- Require nogroup group for %pre (bsc#1192023)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637236800">- git 2.34.0:
  * Release notes:
    https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt</changelog>
  <changelog author="dmueller@suse.com" date="1637496000">- fix url</changelog>
  <changelog author="dmueller@suse.com" date="1637928000">- update to 2.34.1 (bsc#1193722):
  * "git grep" looking in a blob that has non-UTF8 payload was
    completely broken when linked with certain versions of PCREv2
    library in the latest release.
  * "git pull" with any strategy when the other side is behind us
    should succeed as it is a no-op, but doesn't.
  * An earlier change in 2.34.0 caused JGit application (that abused
    GIT_EDITOR mechanism when invoking "git config") to get stuck with
    a SIGTTOU signal; it has been reverted.
  * An earlier change that broke .gitignore matching has been reverted.
  * SubmittingPatches document gained a syntactically incorrect mark-up,
    which has been corrected.</changelog>
  <changelog author="dmueller@suse.com" date="1643371200">- update to 2.35.0:
  * "_" is now treated as any other URL-valid characters in an URL when
  matching the per-URL configuration variable names.
  * The color palette used by "git grep" has been updated to match that
  of GNU grep.
  * "git status --porcelain=v2" now show the number of stash entries
  with --show-stash like the normal output does.
  * "git stash" learned the "--staged" option to stash away what has
  been added to the index (and nothing else).
  * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for
  the newly created branch if "git init" is run.
  * Various operating modes of "git reset" have been made to work
  better with the sparse index.
  * "git submodule deinit" for a submodule whose .git metadata
  directory is embedded in its working tree refused to work, until
  the submodule gets converted to use the "absorbed" form where the
  metadata directory is stored in superproject, and a gitfile at the
  top-level of the working tree of the submodule points at it.  The
  command is taught to convert such submodules to the absorbed form
  as needed.
  * The completion script (in contrib/) learns that the "--date"
  option of commands from the "git log" family takes "human" and
  "auto" as valid values.
  * "Zealous diff3" style of merge conflict presentation has been added.
  * The "git log --format=%(describe)" placeholder has been extended to
  allow passing selected command-line options to the underlying "git
  describe" command.
  * "default" and "reset" have been added to our color palette.
  * The cryptographic signing using ssh keys can specify literal keys
  for keytypes whose name do not begin with the "ssh-" prefix by
  using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256").
  * "git fetch" without the "--update-head-ok" option ought to protect
  a checked out branch from getting updated, to prevent the working
  tree that checks it out to go out of sync.  The code was written
  before the use of "git worktree" got widespread, and only checked
  the branch that was checked out in the current worktree, which has
  been updated.
  * "git name-rev" has been tweaked to give output that is shorter and
  easier to understand.
  * "git apply" has been taught to ignore a message without a patch
  with the "--allow-empty" option.  It also learned to honor the
  "--quiet" option given from the command line.
  * The "init" and "set" subcommands in "git sparse-checkout" have been
  unified for a better user experience and performance.
  * Many git commands that deal with working tree files try to remove a
  directory that becomes empty (i.e. "git switch" from a branch that
  has the directory to another branch that does not would attempt
  remove all files in the directory and the directory itself).  This
  drops users into an unfamiliar situation if the command was run in
  a subdirectory that becomes subject to removal due to the command.
  The commands have been taught to keep an empty directory if it is
  the directory they were started in to avoid surprising users.
  * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is
  done to a piece of e-mail without a patch in it.
  * The default merge message prepared by "git merge" records the name
  of the current branch; the name can be overridden with a new option
  to allow users to pretend a merge is made on a different branch.
  * The way "git p4" shows file sizes in its output has been updated to
  use human-readable units.
  * "git -c branch.autosetupmerge=inherit branch new old" makes "new"
  to have the same upstream as the "old" branch, instead of marking
  "old" itself as its upstream.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1643457600">- update to 2.35.1:
  * fix "rebase" and "stash" in a secondary worktree</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645444800">- "Downgrade" git-gui and gitk Recommends to Suggests.</changelog>
  <changelog author="chris@computersalat.de" date="1646913600">- fix deps for SLES 12</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1649764800">- git 2.35.2 (CVE-2022-24765, bsc#1198234):
  * CVE-2022-24765: git may execute commands defined by other users
    from unexpected worktrees</changelog>
  <changelog author="olaf@aepfle.de" date="1649851200">- Require bash in git-daemon because the service file uses it
- Reword git-daemon.service description to get a useful sentence
  in journalctl -b</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1649937600">- git 2.35.3:
  * usability fix-up for CVE-2022-24765 bsc#1198234:
    '*' can be used as the value for the `safe.directory` variable
    to signal that the user considers that any directory is safe.
  * The code that was meant to parse the new `safe.directory`
    configuration variable was not checking what configuration
    variable was being fed to it</changelog>
  <changelog author="danilo.spinella@suse.com" date="1657713600">- Follow up fix for CVE-2022-24765, potential command injection
  via git worktree.
  (CVE-2022-29187, bsc#1201431)
  * fix-CVE-2022-29187.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1666353600">- Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to
  arbitrary heap writes and remote code execution
  (CVE-2022-39260, bsc#1204456)
  fix-CVE-2022-39260.patch
- Fix CVE-2022-39253, dereference issue with symbolic links via
  the `--local` clone mechanism
  (CVE-2022-39253, bsc#1204455)
  fix-CVE-2022-39253.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1673524800">- Fix CVE-2022-41903, heap overflow in `git archive` and
  `git log --format`
  (CVE-2022-41903, bsc#1207033)
  * fix-CVE-2022-41903.patch
- Fix CVE-2022-23521, gitattributes parsing integer overflow
  (CVE-2022-23521, bsc#1207032)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1676289600">- Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked
  into using its local clone optimization even when using a non-local transport
  (CVE-2023-22490, bsc#1208027)
- Fix CVE-2023-23946, a path outside the working tree can be overwritten as the
  user who is running "git apply"
  (CVE-2023-23946, bsc#1208028)
  * fix-CVE-2023-22490-1.patch
  * fix-CVE-2023-22490-2.patch
  * fix-CVE-2023-22490-3.patch
  * fix-CVE-2023-22490-4.patch</changelog>
  <changelog author="psimons@suse.com" date="1682337600">- Apply "CVE-2023-25652.patch" to fix a security vulnerability
  where by feeding a specially crafted input to `git apply
  - -reject`, a path outside the working tree could be overwritten
  with partially controlled contents (corresponding to the rejected
  hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686]
- Apply "CVE-2023-25815.patch" to fix a security vulnerability that
  exists when Git is compiled with runtime prefix support and runs
  without translated messages, then it still used the gettext
  machinery to display messages, which subsequently potentially
  looked for translated messages in unexpected places. This allowed
  for malicious placement of crafted messages. [CVE-2023-25815,
  bsc#1210686]
- Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch",
  "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a
  security vulnerability that occurred when renaming or deleting a
  section from a configuration file, then certain malicious
  configuration values might have been misinterpreted as the
  beginning of a new configuration section, leading to arbitrary
  configuration injection. [CVE-2023-29007, bsc#1210686]</changelog>
  <changelog author="msuchanek@suse.com" date="1695384000">- Downgrade openssh dependency to recommends (bsc#1215533)</changelog>
</package>
<package pkgid="30acda6fd66c3c1bf2663eecf0cf55830b83f9291e52fcd711c84392e9775154" name="glibc" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.63.1"/>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
  <changelog author="schwab@suse.de" date="1658836800">- memcmp-power10.patch: powerpc: Optimized memcmp for power10
  (jsc#PED-987)</changelog>
  <changelog author="schwab@suse.de" date="1661169600">- x86-shared-non-temporal-threshold.patch: Reversing calculation of
  __x86_shared_non_temporal_threshold (bsc#1201942)</changelog>
  <changelog author="schwab@suse.de" date="1675684800">- dlopen-filter-object.patch: elf: Allow dlopen of filter object to work
  (bsc#1207571, BZ #16272)
- powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors
  with recent GCC</changelog>
  <changelog author="schwab@suse.de" date="1677153600">- strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition
  check (bsc#1208358, BZ #25933)</changelog>
  <changelog author="schwab@suse.de" date="1677585600">- gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow
  (CVE-2023-0687, bsc#1207975, BZ #29444)</changelog>
  <changelog author="schwab@suse.de" date="1678104000">- amd-cacheinfo.patch: x86: Cache computation for AMD architecture
  (bsc#1207957)</changelog>
  <changelog author="schwab@suse.de" date="1678968000">- Exclude static archives from preparation for live patching (bnc#1208721)</changelog>
  <changelog author="schwab@suse.de" date="1680177600">- getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid
  is unset (bsc#1209229, BZ #30235)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1685361600">- ulp-prologue-into-asm-functions.patch: Add support for livepatches
  in ASM written functions (bsc#1211726)</changelog>
  <changelog author="schwab@suse.de" date="1686139200">- resolv-conf-lock.patch: resolv_conf: release lock on allocation failure
  (bsc#1211828, BZ #30527)</changelog>
  <changelog author="schwab@suse.de" date="1688472000">- remove-excessive-p-align-check.patch: elf: Remove excessive p_align
  check on PT_LOAD segments (bsc#1211829, BZ #28688)
- segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829,
  BZ #28676)
- ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the
  first segment (BZ #30452)</changelog>
  <changelog author="schwab@suse.de" date="1689854400">- nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses
  in files database (bsc#1212819, BZ #25457)</changelog>
  <changelog author="schwab@suse.de" date="1690200000">- nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache
  invalidation if epoll is used (bsc#1212910, BZ #29415)</changelog>
  <changelog author="schwab@suse.de" date="1693483200">- gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243)</changelog>
  <changelog author="schwab@suse.de" date="1695038400">- gai-merge-continue-actions.patch: Simplify allocations and fix merge and
  continue actions (CVE-2023-4813, bsc#1215286, BZ #28931)</changelog>
  <changelog author="schwab@suse.de" date="1696420800">- dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to
  page size (bsc#1215891, BZ #28676)</changelog>
</package>
<package pkgid="ad649d262dbd3b40a327662abe0be17d6445167921e6a8b09d23dee2d88514f7" name="glibc" arch="s390x">
  <version epoch="0" ver="2.31" rel="150300.63.1"/>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
  <changelog author="schwab@suse.de" date="1658836800">- memcmp-power10.patch: powerpc: Optimized memcmp for power10
  (jsc#PED-987)</changelog>
  <changelog author="schwab@suse.de" date="1661169600">- x86-shared-non-temporal-threshold.patch: Reversing calculation of
  __x86_shared_non_temporal_threshold (bsc#1201942)</changelog>
  <changelog author="schwab@suse.de" date="1675684800">- dlopen-filter-object.patch: elf: Allow dlopen of filter object to work
  (bsc#1207571, BZ #16272)
- powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors
  with recent GCC</changelog>
  <changelog author="schwab@suse.de" date="1677153600">- strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition
  check (bsc#1208358, BZ #25933)</changelog>
  <changelog author="schwab@suse.de" date="1677585600">- gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow
  (CVE-2023-0687, bsc#1207975, BZ #29444)</changelog>
  <changelog author="schwab@suse.de" date="1678104000">- amd-cacheinfo.patch: x86: Cache computation for AMD architecture
  (bsc#1207957)</changelog>
  <changelog author="schwab@suse.de" date="1678968000">- Exclude static archives from preparation for live patching (bnc#1208721)</changelog>
  <changelog author="schwab@suse.de" date="1680177600">- getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid
  is unset (bsc#1209229, BZ #30235)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1685361600">- ulp-prologue-into-asm-functions.patch: Add support for livepatches
  in ASM written functions (bsc#1211726)</changelog>
  <changelog author="schwab@suse.de" date="1686139200">- resolv-conf-lock.patch: resolv_conf: release lock on allocation failure
  (bsc#1211828, BZ #30527)</changelog>
  <changelog author="schwab@suse.de" date="1688472000">- remove-excessive-p-align-check.patch: elf: Remove excessive p_align
  check on PT_LOAD segments (bsc#1211829, BZ #28688)
- segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829,
  BZ #28676)
- ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the
  first segment (BZ #30452)</changelog>
  <changelog author="schwab@suse.de" date="1689854400">- nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses
  in files database (bsc#1212819, BZ #25457)</changelog>
  <changelog author="schwab@suse.de" date="1690200000">- nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache
  invalidation if epoll is used (bsc#1212910, BZ #29415)</changelog>
  <changelog author="schwab@suse.de" date="1693483200">- gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243)</changelog>
  <changelog author="schwab@suse.de" date="1695038400">- gai-merge-continue-actions.patch: Simplify allocations and fix merge and
  continue actions (CVE-2023-4813, bsc#1215286, BZ #28931)</changelog>
  <changelog author="schwab@suse.de" date="1696420800">- dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to
  page size (bsc#1215891, BZ #28676)</changelog>
</package>
<package pkgid="d0ea80a2074b614361e6b3cca38eadae45a623f187334324f4181298d98cddcd" name="glibc" arch="src">
  <version epoch="0" ver="2.31" rel="150300.63.1"/>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
  <changelog author="schwab@suse.de" date="1658836800">- memcmp-power10.patch: powerpc: Optimized memcmp for power10
  (jsc#PED-987)</changelog>
  <changelog author="schwab@suse.de" date="1661169600">- x86-shared-non-temporal-threshold.patch: Reversing calculation of
  __x86_shared_non_temporal_threshold (bsc#1201942)</changelog>
  <changelog author="schwab@suse.de" date="1675684800">- dlopen-filter-object.patch: elf: Allow dlopen of filter object to work
  (bsc#1207571, BZ #16272)
- powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors
  with recent GCC</changelog>
  <changelog author="schwab@suse.de" date="1677153600">- strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition
  check (bsc#1208358, BZ #25933)</changelog>
  <changelog author="schwab@suse.de" date="1677585600">- gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow
  (CVE-2023-0687, bsc#1207975, BZ #29444)</changelog>
  <changelog author="schwab@suse.de" date="1678104000">- amd-cacheinfo.patch: x86: Cache computation for AMD architecture
  (bsc#1207957)</changelog>
  <changelog author="schwab@suse.de" date="1678968000">- Exclude static archives from preparation for live patching (bnc#1208721)</changelog>
  <changelog author="schwab@suse.de" date="1680177600">- getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid
  is unset (bsc#1209229, BZ #30235)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1685361600">- ulp-prologue-into-asm-functions.patch: Add support for livepatches
  in ASM written functions (bsc#1211726)</changelog>
  <changelog author="schwab@suse.de" date="1686139200">- resolv-conf-lock.patch: resolv_conf: release lock on allocation failure
  (bsc#1211828, BZ #30527)</changelog>
  <changelog author="schwab@suse.de" date="1688472000">- remove-excessive-p-align-check.patch: elf: Remove excessive p_align
  check on PT_LOAD segments (bsc#1211829, BZ #28688)
- segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829,
  BZ #28676)
- ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the
  first segment (BZ #30452)</changelog>
  <changelog author="schwab@suse.de" date="1689854400">- nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses
  in files database (bsc#1212819, BZ #25457)</changelog>
  <changelog author="schwab@suse.de" date="1690200000">- nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache
  invalidation if epoll is used (bsc#1212910, BZ #29415)</changelog>
  <changelog author="schwab@suse.de" date="1693483200">- gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243)</changelog>
  <changelog author="schwab@suse.de" date="1695038400">- gai-merge-continue-actions.patch: Simplify allocations and fix merge and
  continue actions (CVE-2023-4813, bsc#1215286, BZ #28931)</changelog>
  <changelog author="schwab@suse.de" date="1696420800">- dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to
  page size (bsc#1215891, BZ #28676)</changelog>
</package>
<package pkgid="4605e7cd661b0e322fafa1aca67b1963e316f23af0637db0966f5643e1834460" name="glibc" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.63.1"/>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
  <changelog author="schwab@suse.de" date="1658836800">- memcmp-power10.patch: powerpc: Optimized memcmp for power10
  (jsc#PED-987)</changelog>
  <changelog author="schwab@suse.de" date="1661169600">- x86-shared-non-temporal-threshold.patch: Reversing calculation of
  __x86_shared_non_temporal_threshold (bsc#1201942)</changelog>
  <changelog author="schwab@suse.de" date="1675684800">- dlopen-filter-object.patch: elf: Allow dlopen of filter object to work
  (bsc#1207571, BZ #16272)
- powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors
  with recent GCC</changelog>
  <changelog author="schwab@suse.de" date="1677153600">- strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition
  check (bsc#1208358, BZ #25933)</changelog>
  <changelog author="schwab@suse.de" date="1677585600">- gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow
  (CVE-2023-0687, bsc#1207975, BZ #29444)</changelog>
  <changelog author="schwab@suse.de" date="1678104000">- amd-cacheinfo.patch: x86: Cache computation for AMD architecture
  (bsc#1207957)</changelog>
  <changelog author="schwab@suse.de" date="1678968000">- Exclude static archives from preparation for live patching (bnc#1208721)</changelog>
  <changelog author="schwab@suse.de" date="1680177600">- getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid
  is unset (bsc#1209229, BZ #30235)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1685361600">- ulp-prologue-into-asm-functions.patch: Add support for livepatches
  in ASM written functions (bsc#1211726)</changelog>
  <changelog author="schwab@suse.de" date="1686139200">- resolv-conf-lock.patch: resolv_conf: release lock on allocation failure
  (bsc#1211828, BZ #30527)</changelog>
  <changelog author="schwab@suse.de" date="1688472000">- remove-excessive-p-align-check.patch: elf: Remove excessive p_align
  check on PT_LOAD segments (bsc#1211829, BZ #28688)
- segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829,
  BZ #28676)
- ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the
  first segment (BZ #30452)</changelog>
  <changelog author="schwab@suse.de" date="1689854400">- nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses
  in files database (bsc#1212819, BZ #25457)</changelog>
  <changelog author="schwab@suse.de" date="1690200000">- nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache
  invalidation if epoll is used (bsc#1212910, BZ #29415)</changelog>
  <changelog author="schwab@suse.de" date="1693483200">- gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243)</changelog>
  <changelog author="schwab@suse.de" date="1695038400">- gai-merge-continue-actions.patch: Simplify allocations and fix merge and
  continue actions (CVE-2023-4813, bsc#1215286, BZ #28931)</changelog>
  <changelog author="schwab@suse.de" date="1696420800">- dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to
  page size (bsc#1215891, BZ #28676)</changelog>
</package>
<package pkgid="5e1c1af73a4417eebf1eb9984276c9cd3098e05945f69c583aec6c1bb9b59f09" name="glibc-devel" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.63.1"/>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
  <changelog author="schwab@suse.de" date="1658836800">- memcmp-power10.patch: powerpc: Optimized memcmp for power10
  (jsc#PED-987)</changelog>
  <changelog author="schwab@suse.de" date="1661169600">- x86-shared-non-temporal-threshold.patch: Reversing calculation of
  __x86_shared_non_temporal_threshold (bsc#1201942)</changelog>
  <changelog author="schwab@suse.de" date="1675684800">- dlopen-filter-object.patch: elf: Allow dlopen of filter object to work
  (bsc#1207571, BZ #16272)
- powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors
  with recent GCC</changelog>
  <changelog author="schwab@suse.de" date="1677153600">- strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition
  check (bsc#1208358, BZ #25933)</changelog>
  <changelog author="schwab@suse.de" date="1677585600">- gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow
  (CVE-2023-0687, bsc#1207975, BZ #29444)</changelog>
  <changelog author="schwab@suse.de" date="1678104000">- amd-cacheinfo.patch: x86: Cache computation for AMD architecture
  (bsc#1207957)</changelog>
  <changelog author="schwab@suse.de" date="1678968000">- Exclude static archives from preparation for live patching (bnc#1208721)</changelog>
  <changelog author="schwab@suse.de" date="1680177600">- getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid
  is unset (bsc#1209229, BZ #30235)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1685361600">- ulp-prologue-into-asm-functions.patch: Add support for livepatches
  in ASM written functions (bsc#1211726)</changelog>
  <changelog author="schwab@suse.de" date="1686139200">- resolv-conf-lock.patch: resolv_conf: release lock on allocation failure
  (bsc#1211828, BZ #30527)</changelog>
  <changelog author="schwab@suse.de" date="1688472000">- remove-excessive-p-align-check.patch: elf: Remove excessive p_align
  check on PT_LOAD segments (bsc#1211829, BZ #28688)
- segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829,
  BZ #28676)
- ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the
  first segment (BZ #30452)</changelog>
  <changelog author="schwab@suse.de" date="1689854400">- nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses
  in files database (bsc#1212819, BZ #25457)</changelog>
  <changelog author="schwab@suse.de" date="1690200000">- nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache
  invalidation if epoll is used (bsc#1212910, BZ #29415)</changelog>
  <changelog author="schwab@suse.de" date="1693483200">- gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243)</changelog>
  <changelog author="schwab@suse.de" date="1695038400">- gai-merge-continue-actions.patch: Simplify allocations and fix merge and
  continue actions (CVE-2023-4813, bsc#1215286, BZ #28931)</changelog>
  <changelog author="schwab@suse.de" date="1696420800">- dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to
  page size (bsc#1215891, BZ #28676)</changelog>
</package>
<package pkgid="1e42cd387f0f246aad86b0288b503c8c7a72d0d5146dc11a448239da6460302f" name="glibc-devel" arch="s390x">
  <version epoch="0" ver="2.31" rel="150300.63.1"/>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
  <changelog author="schwab@suse.de" date="1658836800">- memcmp-power10.patch: powerpc: Optimized memcmp for power10
  (jsc#PED-987)</changelog>
  <changelog author="schwab@suse.de" date="1661169600">- x86-shared-non-temporal-threshold.patch: Reversing calculation of
  __x86_shared_non_temporal_threshold (bsc#1201942)</changelog>
  <changelog author="schwab@suse.de" date="1675684800">- dlopen-filter-object.patch: elf: Allow dlopen of filter object to work
  (bsc#1207571, BZ #16272)
- powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors
  with recent GCC</changelog>
  <changelog author="schwab@suse.de" date="1677153600">- strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition
  check (bsc#1208358, BZ #25933)</changelog>
  <changelog author="schwab@suse.de" date="1677585600">- gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow
  (CVE-2023-0687, bsc#1207975, BZ #29444)</changelog>
  <changelog author="schwab@suse.de" date="1678104000">- amd-cacheinfo.patch: x86: Cache computation for AMD architecture
  (bsc#1207957)</changelog>
  <changelog author="schwab@suse.de" date="1678968000">- Exclude static archives from preparation for live patching (bnc#1208721)</changelog>
  <changelog author="schwab@suse.de" date="1680177600">- getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid
  is unset (bsc#1209229, BZ #30235)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1685361600">- ulp-prologue-into-asm-functions.patch: Add support for livepatches
  in ASM written functions (bsc#1211726)</changelog>
  <changelog author="schwab@suse.de" date="1686139200">- resolv-conf-lock.patch: resolv_conf: release lock on allocation failure
  (bsc#1211828, BZ #30527)</changelog>
  <changelog author="schwab@suse.de" date="1688472000">- remove-excessive-p-align-check.patch: elf: Remove excessive p_align
  check on PT_LOAD segments (bsc#1211829, BZ #28688)
- segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829,
  BZ #28676)
- ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the
  first segment (BZ #30452)</changelog>
  <changelog author="schwab@suse.de" date="1689854400">- nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses
  in files database (bsc#1212819, BZ #25457)</changelog>
  <changelog author="schwab@suse.de" date="1690200000">- nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache
  invalidation if epoll is used (bsc#1212910, BZ #29415)</changelog>
  <changelog author="schwab@suse.de" date="1693483200">- gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243)</changelog>
  <changelog author="schwab@suse.de" date="1695038400">- gai-merge-continue-actions.patch: Simplify allocations and fix merge and
  continue actions (CVE-2023-4813, bsc#1215286, BZ #28931)</changelog>
  <changelog author="schwab@suse.de" date="1696420800">- dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to
  page size (bsc#1215891, BZ #28676)</changelog>
</package>
<package pkgid="3c938332f6d797bf39bc4940e1d029d511dfcd9c6afaae27d52112374b66495a" name="glibc-devel" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.63.1"/>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
  <changelog author="schwab@suse.de" date="1658836800">- memcmp-power10.patch: powerpc: Optimized memcmp for power10
  (jsc#PED-987)</changelog>
  <changelog author="schwab@suse.de" date="1661169600">- x86-shared-non-temporal-threshold.patch: Reversing calculation of
  __x86_shared_non_temporal_threshold (bsc#1201942)</changelog>
  <changelog author="schwab@suse.de" date="1675684800">- dlopen-filter-object.patch: elf: Allow dlopen of filter object to work
  (bsc#1207571, BZ #16272)
- powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors
  with recent GCC</changelog>
  <changelog author="schwab@suse.de" date="1677153600">- strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition
  check (bsc#1208358, BZ #25933)</changelog>
  <changelog author="schwab@suse.de" date="1677585600">- gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow
  (CVE-2023-0687, bsc#1207975, BZ #29444)</changelog>
  <changelog author="schwab@suse.de" date="1678104000">- amd-cacheinfo.patch: x86: Cache computation for AMD architecture
  (bsc#1207957)</changelog>
  <changelog author="schwab@suse.de" date="1678968000">- Exclude static archives from preparation for live patching (bnc#1208721)</changelog>
  <changelog author="schwab@suse.de" date="1680177600">- getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid
  is unset (bsc#1209229, BZ #30235)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1685361600">- ulp-prologue-into-asm-functions.patch: Add support for livepatches
  in ASM written functions (bsc#1211726)</changelog>
  <changelog author="schwab@suse.de" date="1686139200">- resolv-conf-lock.patch: resolv_conf: release lock on allocation failure
  (bsc#1211828, BZ #30527)</changelog>
  <changelog author="schwab@suse.de" date="1688472000">- remove-excessive-p-align-check.patch: elf: Remove excessive p_align
  check on PT_LOAD segments (bsc#1211829, BZ #28688)
- segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829,
  BZ #28676)
- ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the
  first segment (BZ #30452)</changelog>
  <changelog author="schwab@suse.de" date="1689854400">- nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses
  in files database (bsc#1212819, BZ #25457)</changelog>
  <changelog author="schwab@suse.de" date="1690200000">- nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache
  invalidation if epoll is used (bsc#1212910, BZ #29415)</changelog>
  <changelog author="schwab@suse.de" date="1693483200">- gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243)</changelog>
  <changelog author="schwab@suse.de" date="1695038400">- gai-merge-continue-actions.patch: Simplify allocations and fix merge and
  continue actions (CVE-2023-4813, bsc#1215286, BZ #28931)</changelog>
  <changelog author="schwab@suse.de" date="1696420800">- dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to
  page size (bsc#1215891, BZ #28676)</changelog>
</package>
<package pkgid="9f01671f44dbf858a609d85be7f61922fade4a66bc6dcf238407d41389648f93" name="glibc-locale" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.63.1"/>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
  <changelog author="schwab@suse.de" date="1658836800">- memcmp-power10.patch: powerpc: Optimized memcmp for power10
  (jsc#PED-987)</changelog>
  <changelog author="schwab@suse.de" date="1661169600">- x86-shared-non-temporal-threshold.patch: Reversing calculation of
  __x86_shared_non_temporal_threshold (bsc#1201942)</changelog>
  <changelog author="schwab@suse.de" date="1675684800">- dlopen-filter-object.patch: elf: Allow dlopen of filter object to work
  (bsc#1207571, BZ #16272)
- powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors
  with recent GCC</changelog>
  <changelog author="schwab@suse.de" date="1677153600">- strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition
  check (bsc#1208358, BZ #25933)</changelog>
  <changelog author="schwab@suse.de" date="1677585600">- gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow
  (CVE-2023-0687, bsc#1207975, BZ #29444)</changelog>
  <changelog author="schwab@suse.de" date="1678104000">- amd-cacheinfo.patch: x86: Cache computation for AMD architecture
  (bsc#1207957)</changelog>
  <changelog author="schwab@suse.de" date="1678968000">- Exclude static archives from preparation for live patching (bnc#1208721)</changelog>
  <changelog author="schwab@suse.de" date="1680177600">- getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid
  is unset (bsc#1209229, BZ #30235)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1685361600">- ulp-prologue-into-asm-functions.patch: Add support for livepatches
  in ASM written functions (bsc#1211726)</changelog>
  <changelog author="schwab@suse.de" date="1686139200">- resolv-conf-lock.patch: resolv_conf: release lock on allocation failure
  (bsc#1211828, BZ #30527)</changelog>
  <changelog author="schwab@suse.de" date="1688472000">- remove-excessive-p-align-check.patch: elf: Remove excessive p_align
  check on PT_LOAD segments (bsc#1211829, BZ #28688)
- segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829,
  BZ #28676)
- ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the
  first segment (BZ #30452)</changelog>
  <changelog author="schwab@suse.de" date="1689854400">- nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses
  in files database (bsc#1212819, BZ #25457)</changelog>
  <changelog author="schwab@suse.de" date="1690200000">- nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache
  invalidation if epoll is used (bsc#1212910, BZ #29415)</changelog>
  <changelog author="schwab@suse.de" date="1693483200">- gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243)</changelog>
  <changelog author="schwab@suse.de" date="1695038400">- gai-merge-continue-actions.patch: Simplify allocations and fix merge and
  continue actions (CVE-2023-4813, bsc#1215286, BZ #28931)</changelog>
  <changelog author="schwab@suse.de" date="1696420800">- dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to
  page size (bsc#1215891, BZ #28676)</changelog>
</package>
<package pkgid="8c341d756d66e6f088c4b7a31f084720e29c59e836edbc73b5e5ab8d173e5583" name="glibc-locale" arch="s390x">
  <version epoch="0" ver="2.31" rel="150300.63.1"/>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
  <changelog author="schwab@suse.de" date="1658836800">- memcmp-power10.patch: powerpc: Optimized memcmp for power10
  (jsc#PED-987)</changelog>
  <changelog author="schwab@suse.de" date="1661169600">- x86-shared-non-temporal-threshold.patch: Reversing calculation of
  __x86_shared_non_temporal_threshold (bsc#1201942)</changelog>
  <changelog author="schwab@suse.de" date="1675684800">- dlopen-filter-object.patch: elf: Allow dlopen of filter object to work
  (bsc#1207571, BZ #16272)
- powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors
  with recent GCC</changelog>
  <changelog author="schwab@suse.de" date="1677153600">- strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition
  check (bsc#1208358, BZ #25933)</changelog>
  <changelog author="schwab@suse.de" date="1677585600">- gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow
  (CVE-2023-0687, bsc#1207975, BZ #29444)</changelog>
  <changelog author="schwab@suse.de" date="1678104000">- amd-cacheinfo.patch: x86: Cache computation for AMD architecture
  (bsc#1207957)</changelog>
  <changelog author="schwab@suse.de" date="1678968000">- Exclude static archives from preparation for live patching (bnc#1208721)</changelog>
  <changelog author="schwab@suse.de" date="1680177600">- getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid
  is unset (bsc#1209229, BZ #30235)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1685361600">- ulp-prologue-into-asm-functions.patch: Add support for livepatches
  in ASM written functions (bsc#1211726)</changelog>
  <changelog author="schwab@suse.de" date="1686139200">- resolv-conf-lock.patch: resolv_conf: release lock on allocation failure
  (bsc#1211828, BZ #30527)</changelog>
  <changelog author="schwab@suse.de" date="1688472000">- remove-excessive-p-align-check.patch: elf: Remove excessive p_align
  check on PT_LOAD segments (bsc#1211829, BZ #28688)
- segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829,
  BZ #28676)
- ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the
  first segment (BZ #30452)</changelog>
  <changelog author="schwab@suse.de" date="1689854400">- nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses
  in files database (bsc#1212819, BZ #25457)</changelog>
  <changelog author="schwab@suse.de" date="1690200000">- nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache
  invalidation if epoll is used (bsc#1212910, BZ #29415)</changelog>
  <changelog author="schwab@suse.de" date="1693483200">- gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243)</changelog>
  <changelog author="schwab@suse.de" date="1695038400">- gai-merge-continue-actions.patch: Simplify allocations and fix merge and
  continue actions (CVE-2023-4813, bsc#1215286, BZ #28931)</changelog>
  <changelog author="schwab@suse.de" date="1696420800">- dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to
  page size (bsc#1215891, BZ #28676)</changelog>
</package>
<package pkgid="4dd56c5df933804b6c5191b47758d8cff23999edf9869a0a0e5023d3142472bb" name="glibc-locale" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.63.1"/>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
  <changelog author="schwab@suse.de" date="1658836800">- memcmp-power10.patch: powerpc: Optimized memcmp for power10
  (jsc#PED-987)</changelog>
  <changelog author="schwab@suse.de" date="1661169600">- x86-shared-non-temporal-threshold.patch: Reversing calculation of
  __x86_shared_non_temporal_threshold (bsc#1201942)</changelog>
  <changelog author="schwab@suse.de" date="1675684800">- dlopen-filter-object.patch: elf: Allow dlopen of filter object to work
  (bsc#1207571, BZ #16272)
- powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors
  with recent GCC</changelog>
  <changelog author="schwab@suse.de" date="1677153600">- strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition
  check (bsc#1208358, BZ #25933)</changelog>
  <changelog author="schwab@suse.de" date="1677585600">- gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow
  (CVE-2023-0687, bsc#1207975, BZ #29444)</changelog>
  <changelog author="schwab@suse.de" date="1678104000">- amd-cacheinfo.patch: x86: Cache computation for AMD architecture
  (bsc#1207957)</changelog>
  <changelog author="schwab@suse.de" date="1678968000">- Exclude static archives from preparation for live patching (bnc#1208721)</changelog>
  <changelog author="schwab@suse.de" date="1680177600">- getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid
  is unset (bsc#1209229, BZ #30235)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1685361600">- ulp-prologue-into-asm-functions.patch: Add support for livepatches
  in ASM written functions (bsc#1211726)</changelog>
  <changelog author="schwab@suse.de" date="1686139200">- resolv-conf-lock.patch: resolv_conf: release lock on allocation failure
  (bsc#1211828, BZ #30527)</changelog>
  <changelog author="schwab@suse.de" date="1688472000">- remove-excessive-p-align-check.patch: elf: Remove excessive p_align
  check on PT_LOAD segments (bsc#1211829, BZ #28688)
- segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829,
  BZ #28676)
- ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the
  first segment (BZ #30452)</changelog>
  <changelog author="schwab@suse.de" date="1689854400">- nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses
  in files database (bsc#1212819, BZ #25457)</changelog>
  <changelog author="schwab@suse.de" date="1690200000">- nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache
  invalidation if epoll is used (bsc#1212910, BZ #29415)</changelog>
  <changelog author="schwab@suse.de" date="1693483200">- gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243)</changelog>
  <changelog author="schwab@suse.de" date="1695038400">- gai-merge-continue-actions.patch: Simplify allocations and fix merge and
  continue actions (CVE-2023-4813, bsc#1215286, BZ #28931)</changelog>
  <changelog author="schwab@suse.de" date="1696420800">- dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to
  page size (bsc#1215891, BZ #28676)</changelog>
</package>
<package pkgid="8587611444fe60667d2110a9284c55e29090f2d16c21f210c8333a68b45a47e2" name="glibc-locale-base" arch="aarch64">
  <version epoch="0" ver="2.31" rel="150300.63.1"/>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
  <changelog author="schwab@suse.de" date="1658836800">- memcmp-power10.patch: powerpc: Optimized memcmp for power10
  (jsc#PED-987)</changelog>
  <changelog author="schwab@suse.de" date="1661169600">- x86-shared-non-temporal-threshold.patch: Reversing calculation of
  __x86_shared_non_temporal_threshold (bsc#1201942)</changelog>
  <changelog author="schwab@suse.de" date="1675684800">- dlopen-filter-object.patch: elf: Allow dlopen of filter object to work
  (bsc#1207571, BZ #16272)
- powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors
  with recent GCC</changelog>
  <changelog author="schwab@suse.de" date="1677153600">- strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition
  check (bsc#1208358, BZ #25933)</changelog>
  <changelog author="schwab@suse.de" date="1677585600">- gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow
  (CVE-2023-0687, bsc#1207975, BZ #29444)</changelog>
  <changelog author="schwab@suse.de" date="1678104000">- amd-cacheinfo.patch: x86: Cache computation for AMD architecture
  (bsc#1207957)</changelog>
  <changelog author="schwab@suse.de" date="1678968000">- Exclude static archives from preparation for live patching (bnc#1208721)</changelog>
  <changelog author="schwab@suse.de" date="1680177600">- getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid
  is unset (bsc#1209229, BZ #30235)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1685361600">- ulp-prologue-into-asm-functions.patch: Add support for livepatches
  in ASM written functions (bsc#1211726)</changelog>
  <changelog author="schwab@suse.de" date="1686139200">- resolv-conf-lock.patch: resolv_conf: release lock on allocation failure
  (bsc#1211828, BZ #30527)</changelog>
  <changelog author="schwab@suse.de" date="1688472000">- remove-excessive-p-align-check.patch: elf: Remove excessive p_align
  check on PT_LOAD segments (bsc#1211829, BZ #28688)
- segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829,
  BZ #28676)
- ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the
  first segment (BZ #30452)</changelog>
  <changelog author="schwab@suse.de" date="1689854400">- nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses
  in files database (bsc#1212819, BZ #25457)</changelog>
  <changelog author="schwab@suse.de" date="1690200000">- nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache
  invalidation if epoll is used (bsc#1212910, BZ #29415)</changelog>
  <changelog author="schwab@suse.de" date="1693483200">- gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243)</changelog>
  <changelog author="schwab@suse.de" date="1695038400">- gai-merge-continue-actions.patch: Simplify allocations and fix merge and
  continue actions (CVE-2023-4813, bsc#1215286, BZ #28931)</changelog>
  <changelog author="schwab@suse.de" date="1696420800">- dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to
  page size (bsc#1215891, BZ #28676)</changelog>
</package>
<package pkgid="ba2dea237ae8f2976c1d96a46e27cfa63561d5974ddcd9704626be32512078c3" name="glibc-locale-base" arch="s390x">
  <version epoch="0" ver="2.31" rel="150300.63.1"/>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
  <changelog author="schwab@suse.de" date="1658836800">- memcmp-power10.patch: powerpc: Optimized memcmp for power10
  (jsc#PED-987)</changelog>
  <changelog author="schwab@suse.de" date="1661169600">- x86-shared-non-temporal-threshold.patch: Reversing calculation of
  __x86_shared_non_temporal_threshold (bsc#1201942)</changelog>
  <changelog author="schwab@suse.de" date="1675684800">- dlopen-filter-object.patch: elf: Allow dlopen of filter object to work
  (bsc#1207571, BZ #16272)
- powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors
  with recent GCC</changelog>
  <changelog author="schwab@suse.de" date="1677153600">- strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition
  check (bsc#1208358, BZ #25933)</changelog>
  <changelog author="schwab@suse.de" date="1677585600">- gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow
  (CVE-2023-0687, bsc#1207975, BZ #29444)</changelog>
  <changelog author="schwab@suse.de" date="1678104000">- amd-cacheinfo.patch: x86: Cache computation for AMD architecture
  (bsc#1207957)</changelog>
  <changelog author="schwab@suse.de" date="1678968000">- Exclude static archives from preparation for live patching (bnc#1208721)</changelog>
  <changelog author="schwab@suse.de" date="1680177600">- getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid
  is unset (bsc#1209229, BZ #30235)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1685361600">- ulp-prologue-into-asm-functions.patch: Add support for livepatches
  in ASM written functions (bsc#1211726)</changelog>
  <changelog author="schwab@suse.de" date="1686139200">- resolv-conf-lock.patch: resolv_conf: release lock on allocation failure
  (bsc#1211828, BZ #30527)</changelog>
  <changelog author="schwab@suse.de" date="1688472000">- remove-excessive-p-align-check.patch: elf: Remove excessive p_align
  check on PT_LOAD segments (bsc#1211829, BZ #28688)
- segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829,
  BZ #28676)
- ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the
  first segment (BZ #30452)</changelog>
  <changelog author="schwab@suse.de" date="1689854400">- nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses
  in files database (bsc#1212819, BZ #25457)</changelog>
  <changelog author="schwab@suse.de" date="1690200000">- nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache
  invalidation if epoll is used (bsc#1212910, BZ #29415)</changelog>
  <changelog author="schwab@suse.de" date="1693483200">- gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243)</changelog>
  <changelog author="schwab@suse.de" date="1695038400">- gai-merge-continue-actions.patch: Simplify allocations and fix merge and
  continue actions (CVE-2023-4813, bsc#1215286, BZ #28931)</changelog>
  <changelog author="schwab@suse.de" date="1696420800">- dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to
  page size (bsc#1215891, BZ #28676)</changelog>
</package>
<package pkgid="66d9e0aee5e99a6c79ef53246e613f036f757c5548205bc0f9937a0ff3428e00" name="glibc-locale-base" arch="x86_64">
  <version epoch="0" ver="2.31" rel="150300.63.1"/>
  <changelog author="schwab@suse.de" date="1654776000">- strncpy-power9-vsx.patch: powerpc: Fix VSX register number on
  __strncpy_power9 (bsc#1200334, BZ #29197)</changelog>
  <changelog author="schwab@suse.de" date="1656417600">- static-tls-surplus.patch: rtld: Avoid using up static TLS surplus for
  optimizations (bsc#1200855, BZ #25051)</changelog>
  <changelog author="schwab@suse.de" date="1658232000">- static-tls-surplus.patch: Remove tunables (bsc#1201560)</changelog>
  <changelog author="schwab@suse.de" date="1658318400">- disable-check-consistency.patch: i386: Disable check_consistency for GCC
  5 and above (bsc#1201640, BZ #25788)</changelog>
  <changelog author="schwab@suse.de" date="1658836800">- memcmp-power10.patch: powerpc: Optimized memcmp for power10
  (jsc#PED-987)</changelog>
  <changelog author="schwab@suse.de" date="1661169600">- x86-shared-non-temporal-threshold.patch: Reversing calculation of
  __x86_shared_non_temporal_threshold (bsc#1201942)</changelog>
  <changelog author="schwab@suse.de" date="1675684800">- dlopen-filter-object.patch: elf: Allow dlopen of filter object to work
  (bsc#1207571, BZ #16272)
- powerpc-tst-ucontext.patch: powerpc: Fix unrecognized instruction errors
  with recent GCC</changelog>
  <changelog author="schwab@suse.de" date="1677153600">- strncmp-avx2-boundary.patch: Fix avx2 strncmp offset compare condition
  check (bsc#1208358, BZ #25933)</changelog>
  <changelog author="schwab@suse.de" date="1677585600">- gmon-hash-table-size.patch: gmon: Fix allocated buffer overflow
  (CVE-2023-0687, bsc#1207975, BZ #29444)</changelog>
  <changelog author="schwab@suse.de" date="1678104000">- amd-cacheinfo.patch: x86: Cache computation for AMD architecture
  (bsc#1207957)</changelog>
  <changelog author="schwab@suse.de" date="1678968000">- Exclude static archives from preparation for live patching (bnc#1208721)</changelog>
  <changelog author="schwab@suse.de" date="1680177600">- getlogin-no-loginuid.patch: getlogin_r: fix missing fallback if loginuid
  is unset (bsc#1209229, BZ #30235)</changelog>
  <changelog author="giuliano.belinassi@suse.com" date="1685361600">- ulp-prologue-into-asm-functions.patch: Add support for livepatches
  in ASM written functions (bsc#1211726)</changelog>
  <changelog author="schwab@suse.de" date="1686139200">- resolv-conf-lock.patch: resolv_conf: release lock on allocation failure
  (bsc#1211828, BZ #30527)</changelog>
  <changelog author="schwab@suse.de" date="1688472000">- remove-excessive-p-align-check.patch: elf: Remove excessive p_align
  check on PT_LOAD segments (bsc#1211829, BZ #28688)
- segment-align.patch: elf: Properly align PT_LOAD segments (bsc#1211829,
  BZ #28676)
- ld-so-always-use-map-copy.patch: ld.so: Always use MAP_COPY to map the
  first segment (BZ #30452)</changelog>
  <changelog author="schwab@suse.de" date="1689854400">- nss-files-hosts-v4mapped.patch: Restore lookup of IPv4 mapped addresses
  in files database (bsc#1212819, BZ #25457)</changelog>
  <changelog author="schwab@suse.de" date="1690200000">- nscd-netlink-cache-invalidation.patch: nscd: Fix netlink cache
  invalidation if epoll is used (bsc#1212910, BZ #29415)</changelog>
  <changelog author="schwab@suse.de" date="1693483200">- gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243)</changelog>
  <changelog author="schwab@suse.de" date="1695038400">- gai-merge-continue-actions.patch: Simplify allocations and fix merge and
  continue actions (CVE-2023-4813, bsc#1215286, BZ #28931)</changelog>
  <changelog author="schwab@suse.de" date="1696420800">- dl-map-segment-align-munmap.patch: elf: Align argument of __munmap to
  page size (bsc#1215891, BZ #28676)</changelog>
</package>
<package pkgid="ce22197a7b677eb6934a8903afe3def0ad3069a28c463ed498ffee8d42e5456f" name="grub2" arch="aarch64">
  <version epoch="0" ver="2.06" rel="150500.29.8.1"/>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1666958400">- NVMeoFC support on grub (jsc#PED-996)
  * 0001-ieee1275-add-support-for-NVMeoFC.patch
  * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch
  * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch
  * 0004-ofpath-controller-name-update.patch
- TDX: Enhance grub2 measurement to TD RTMR (jsc#PED-1265)
  * 0001-commands-efi-tpm-Refine-the-status-of-log-event.patch
  * 0002-commands-efi-tpm-Use-grub_strcpy-instead-of-grub_mem.patch
  * 0003-efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch
- Measure the kernel on POWER10 and extend TPM PCRs (PED-1990)
  * 0001-ibmvtpm-Add-support-for-trusted-boot-using-a-vTPM-2..patch
  * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
  <changelog author="mchang@suse.com" date="1669118400">- Support grub2-install on LUKS2 encrypted device
  * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch
  * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch
  * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch</changelog>
  <changelog author="mchang@suse.com" date="1670241600">- Add tpm to signed grub.elf image (PED-1990) (bsc#1205912)
- Increase initial heap size from 1/4 to 1/3
  * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch</changelog>
  <changelog author="mchang@suse.com" date="1671451200">- Setup multiple device paths for a nvmf boot device (bsc#1205666)
  * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch</changelog>
  <changelog author="mchang@suse.com" date="1671796800">- Make grub.cfg invariant to efi and legacy platforms (bsc#1205200)
- Removed patch linuxefi
  * grub2-secureboot-provide-linuxefi-config.patch
  * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch
  * grub2-secureboot-use-linuxefi-on-uefi.patch
- Rediff
  * grub2-btrfs-05-grub2-mkconfig.patch
  * grub2-efi-xen-cmdline.patch
  * grub2-s390x-05-grub2-mkconfig.patch
  * grub2-suse-remove-linux-root-param.patch</changelog>
  <changelog author="mchang@suse.com" date="1675771200">- Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064)
  * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch</changelog>
  <changelog author="mchang@suse.com" date="1675857600">- Fix nvmf boot device setup (bsc#1207811)
  * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch</changelog>
  <changelog author="mchang@suse.com" date="1677067200">- Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024)
  * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch
  * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch
- Fix lpar got hung at grub after inactive migration (bsc#1207684)
  * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch</changelog>
  <changelog author="glin@suse.com" date="1677153600">- Move unsupported zfs modules into 'extras' packages
  (bsc#1205554) (PED-2947)</changelog>
  <changelog author="mchang@suse.com" date="1677844800">- Make grub more robust against storage race condition causing system boot
  failures (bsc#1189036)
  * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch</changelog>
  <changelog author="mchang@suse.com" date="1679572800">- Fix aarch64 kiwi image's file not found due to '/@' prepended to path in
  btrfs filesystem. (bsc#1209165)
  * grub2-btrfs-05-grub2-mkconfig.patch</changelog>
  <changelog author="mchang@suse.com" date="1680782400">- Fix installation over serial console ends up in infinite boot loop
  (bsc#1187810) (bsc#1209667) (bsc#1209372)
  * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch</changelog>
  <changelog author="mchang@suse.com" date="1681214400">- Resolve some issues with OS boot failure on PPC NVMe-oF disks and made
  enhancements to PPC secure boot's root device discovery config (bsc#1207230)
- Ensure get_devargs and get_devname functions are consistent
  * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch
- Fix regex for Open Firmware device specifier with encoded commas
  * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch
- Fix regular expression in PPC secure boot config to prevent escaped commas
  from being treated as delimiters when retrieving partition substrings.
- Use prep_load_env in PPC secure boot config to handle unset host-specific
  environment variables and ensure successful command execution.
  * 0004-Introduce-prep_load_env-command.patch
- Refreshed
  * 0005-export-environment-at-start-up.patch</changelog>
  <changelog author="mchang@suse.com" date="1681819200">- Fix no prep partition error on non-PReP architectures by making the
  prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489)
  * 0004-Introduce-prep_load_env-command.patch
- Fix the issue of freeing an uninitialized pointer
  * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch
- Rediff
  * 0005-export-environment-at-start-up.patch</changelog>
  <changelog author="mchang@suse.com" date="1682078400">- Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581)
  * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch
  * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch</changelog>
  <changelog author="mchang@suse.com" date="1683201600">- grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563)</changelog>
  <changelog author="mchang@suse.com" date="1695211200">- Fix a boot delay regression in PowerPC PXE boot (bsc#1201300)
  * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch</changelog>
  <changelog author="mchang@suse.com" date="1696593600">- Fix CVE-2023-4692 (bsc#1215935)
- Fix CVE-2023-4693 (bsc#1215936)
  * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch
  * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch
  * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch
  * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch
  * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch
  * 0006-fs-ntfs-Make-code-more-readable.patch
- Bump upstream SBAT generation to 4</changelog>
</package>
<package pkgid="55cb4b88f21d8fc6648344775a4085830869931772ef26d0e935e86242dbd5b1" name="grub2" arch="s390x">
  <version epoch="0" ver="2.06" rel="150500.29.8.1"/>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1666958400">- NVMeoFC support on grub (jsc#PED-996)
  * 0001-ieee1275-add-support-for-NVMeoFC.patch
  * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch
  * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch
  * 0004-ofpath-controller-name-update.patch
- TDX: Enhance grub2 measurement to TD RTMR (jsc#PED-1265)
  * 0001-commands-efi-tpm-Refine-the-status-of-log-event.patch
  * 0002-commands-efi-tpm-Use-grub_strcpy-instead-of-grub_mem.patch
  * 0003-efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch
- Measure the kernel on POWER10 and extend TPM PCRs (PED-1990)
  * 0001-ibmvtpm-Add-support-for-trusted-boot-using-a-vTPM-2..patch
  * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
  <changelog author="mchang@suse.com" date="1669118400">- Support grub2-install on LUKS2 encrypted device
  * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch
  * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch
  * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch</changelog>
  <changelog author="mchang@suse.com" date="1670241600">- Add tpm to signed grub.elf image (PED-1990) (bsc#1205912)
- Increase initial heap size from 1/4 to 1/3
  * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch</changelog>
  <changelog author="mchang@suse.com" date="1671451200">- Setup multiple device paths for a nvmf boot device (bsc#1205666)
  * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch</changelog>
  <changelog author="mchang@suse.com" date="1671796800">- Make grub.cfg invariant to efi and legacy platforms (bsc#1205200)
- Removed patch linuxefi
  * grub2-secureboot-provide-linuxefi-config.patch
  * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch
  * grub2-secureboot-use-linuxefi-on-uefi.patch
- Rediff
  * grub2-btrfs-05-grub2-mkconfig.patch
  * grub2-efi-xen-cmdline.patch
  * grub2-s390x-05-grub2-mkconfig.patch
  * grub2-suse-remove-linux-root-param.patch</changelog>
  <changelog author="mchang@suse.com" date="1675771200">- Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064)
  * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch</changelog>
  <changelog author="mchang@suse.com" date="1675857600">- Fix nvmf boot device setup (bsc#1207811)
  * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch</changelog>
  <changelog author="mchang@suse.com" date="1677067200">- Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024)
  * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch
  * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch
- Fix lpar got hung at grub after inactive migration (bsc#1207684)
  * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch</changelog>
  <changelog author="glin@suse.com" date="1677153600">- Move unsupported zfs modules into 'extras' packages
  (bsc#1205554) (PED-2947)</changelog>
  <changelog author="mchang@suse.com" date="1677844800">- Make grub more robust against storage race condition causing system boot
  failures (bsc#1189036)
  * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch</changelog>
  <changelog author="mchang@suse.com" date="1679572800">- Fix aarch64 kiwi image's file not found due to '/@' prepended to path in
  btrfs filesystem. (bsc#1209165)
  * grub2-btrfs-05-grub2-mkconfig.patch</changelog>
  <changelog author="mchang@suse.com" date="1680782400">- Fix installation over serial console ends up in infinite boot loop
  (bsc#1187810) (bsc#1209667) (bsc#1209372)
  * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch</changelog>
  <changelog author="mchang@suse.com" date="1681214400">- Resolve some issues with OS boot failure on PPC NVMe-oF disks and made
  enhancements to PPC secure boot's root device discovery config (bsc#1207230)
- Ensure get_devargs and get_devname functions are consistent
  * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch
- Fix regex for Open Firmware device specifier with encoded commas
  * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch
- Fix regular expression in PPC secure boot config to prevent escaped commas
  from being treated as delimiters when retrieving partition substrings.
- Use prep_load_env in PPC secure boot config to handle unset host-specific
  environment variables and ensure successful command execution.
  * 0004-Introduce-prep_load_env-command.patch
- Refreshed
  * 0005-export-environment-at-start-up.patch</changelog>
  <changelog author="mchang@suse.com" date="1681819200">- Fix no prep partition error on non-PReP architectures by making the
  prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489)
  * 0004-Introduce-prep_load_env-command.patch
- Fix the issue of freeing an uninitialized pointer
  * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch
- Rediff
  * 0005-export-environment-at-start-up.patch</changelog>
  <changelog author="mchang@suse.com" date="1682078400">- Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581)
  * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch
  * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch</changelog>
  <changelog author="mchang@suse.com" date="1683201600">- grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563)</changelog>
  <changelog author="mchang@suse.com" date="1695211200">- Fix a boot delay regression in PowerPC PXE boot (bsc#1201300)
  * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch</changelog>
  <changelog author="mchang@suse.com" date="1696593600">- Fix CVE-2023-4692 (bsc#1215935)
- Fix CVE-2023-4693 (bsc#1215936)
  * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch
  * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch
  * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch
  * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch
  * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch
  * 0006-fs-ntfs-Make-code-more-readable.patch
- Bump upstream SBAT generation to 4</changelog>
</package>
<package pkgid="d4066cedcd93c0b8bc934408ef56199069ed750dbc47332e1f16d5e0040d625f" name="grub2" arch="src">
  <version epoch="0" ver="2.06" rel="150500.29.8.1"/>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1666958400">- NVMeoFC support on grub (jsc#PED-996)
  * 0001-ieee1275-add-support-for-NVMeoFC.patch
  * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch
  * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch
  * 0004-ofpath-controller-name-update.patch
- TDX: Enhance grub2 measurement to TD RTMR (jsc#PED-1265)
  * 0001-commands-efi-tpm-Refine-the-status-of-log-event.patch
  * 0002-commands-efi-tpm-Use-grub_strcpy-instead-of-grub_mem.patch
  * 0003-efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch
- Measure the kernel on POWER10 and extend TPM PCRs (PED-1990)
  * 0001-ibmvtpm-Add-support-for-trusted-boot-using-a-vTPM-2..patch
  * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
  <changelog author="mchang@suse.com" date="1669118400">- Support grub2-install on LUKS2 encrypted device
  * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch
  * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch
  * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch</changelog>
  <changelog author="mchang@suse.com" date="1670241600">- Add tpm to signed grub.elf image (PED-1990) (bsc#1205912)
- Increase initial heap size from 1/4 to 1/3
  * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch</changelog>
  <changelog author="mchang@suse.com" date="1671451200">- Setup multiple device paths for a nvmf boot device (bsc#1205666)
  * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch</changelog>
  <changelog author="mchang@suse.com" date="1671796800">- Make grub.cfg invariant to efi and legacy platforms (bsc#1205200)
- Removed patch linuxefi
  * grub2-secureboot-provide-linuxefi-config.patch
  * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch
  * grub2-secureboot-use-linuxefi-on-uefi.patch
- Rediff
  * grub2-btrfs-05-grub2-mkconfig.patch
  * grub2-efi-xen-cmdline.patch
  * grub2-s390x-05-grub2-mkconfig.patch
  * grub2-suse-remove-linux-root-param.patch</changelog>
  <changelog author="mchang@suse.com" date="1675771200">- Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064)
  * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch</changelog>
  <changelog author="mchang@suse.com" date="1675857600">- Fix nvmf boot device setup (bsc#1207811)
  * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch</changelog>
  <changelog author="mchang@suse.com" date="1677067200">- Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024)
  * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch
  * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch
- Fix lpar got hung at grub after inactive migration (bsc#1207684)
  * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch</changelog>
  <changelog author="glin@suse.com" date="1677153600">- Move unsupported zfs modules into 'extras' packages
  (bsc#1205554) (PED-2947)</changelog>
  <changelog author="mchang@suse.com" date="1677844800">- Make grub more robust against storage race condition causing system boot
  failures (bsc#1189036)
  * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch</changelog>
  <changelog author="mchang@suse.com" date="1679572800">- Fix aarch64 kiwi image's file not found due to '/@' prepended to path in
  btrfs filesystem. (bsc#1209165)
  * grub2-btrfs-05-grub2-mkconfig.patch</changelog>
  <changelog author="mchang@suse.com" date="1680782400">- Fix installation over serial console ends up in infinite boot loop
  (bsc#1187810) (bsc#1209667) (bsc#1209372)
  * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch</changelog>
  <changelog author="mchang@suse.com" date="1681214400">- Resolve some issues with OS boot failure on PPC NVMe-oF disks and made
  enhancements to PPC secure boot's root device discovery config (bsc#1207230)
- Ensure get_devargs and get_devname functions are consistent
  * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch
- Fix regex for Open Firmware device specifier with encoded commas
  * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch
- Fix regular expression in PPC secure boot config to prevent escaped commas
  from being treated as delimiters when retrieving partition substrings.
- Use prep_load_env in PPC secure boot config to handle unset host-specific
  environment variables and ensure successful command execution.
  * 0004-Introduce-prep_load_env-command.patch
- Refreshed
  * 0005-export-environment-at-start-up.patch</changelog>
  <changelog author="mchang@suse.com" date="1681819200">- Fix no prep partition error on non-PReP architectures by making the
  prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489)
  * 0004-Introduce-prep_load_env-command.patch
- Fix the issue of freeing an uninitialized pointer
  * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch
- Rediff
  * 0005-export-environment-at-start-up.patch</changelog>
  <changelog author="mchang@suse.com" date="1682078400">- Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581)
  * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch
  * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch</changelog>
  <changelog author="mchang@suse.com" date="1683201600">- grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563)</changelog>
  <changelog author="mchang@suse.com" date="1695211200">- Fix a boot delay regression in PowerPC PXE boot (bsc#1201300)
  * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch</changelog>
  <changelog author="mchang@suse.com" date="1696593600">- Fix CVE-2023-4692 (bsc#1215935)
- Fix CVE-2023-4693 (bsc#1215936)
  * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch
  * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch
  * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch
  * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch
  * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch
  * 0006-fs-ntfs-Make-code-more-readable.patch
- Bump upstream SBAT generation to 4</changelog>
</package>
<package pkgid="9fcf301cd8dfad6632372bcc5d8560f12559b193a6e226a3fd28cd2aa17ad2cd" name="grub2" arch="x86_64">
  <version epoch="0" ver="2.06" rel="150500.29.8.1"/>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1666958400">- NVMeoFC support on grub (jsc#PED-996)
  * 0001-ieee1275-add-support-for-NVMeoFC.patch
  * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch
  * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch
  * 0004-ofpath-controller-name-update.patch
- TDX: Enhance grub2 measurement to TD RTMR (jsc#PED-1265)
  * 0001-commands-efi-tpm-Refine-the-status-of-log-event.patch
  * 0002-commands-efi-tpm-Use-grub_strcpy-instead-of-grub_mem.patch
  * 0003-efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch
- Measure the kernel on POWER10 and extend TPM PCRs (PED-1990)
  * 0001-ibmvtpm-Add-support-for-trusted-boot-using-a-vTPM-2..patch
  * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
  <changelog author="mchang@suse.com" date="1669118400">- Support grub2-install on LUKS2 encrypted device
  * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch
  * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch
  * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch</changelog>
  <changelog author="mchang@suse.com" date="1670241600">- Add tpm to signed grub.elf image (PED-1990) (bsc#1205912)
- Increase initial heap size from 1/4 to 1/3
  * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch</changelog>
  <changelog author="mchang@suse.com" date="1671451200">- Setup multiple device paths for a nvmf boot device (bsc#1205666)
  * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch</changelog>
  <changelog author="mchang@suse.com" date="1671796800">- Make grub.cfg invariant to efi and legacy platforms (bsc#1205200)
- Removed patch linuxefi
  * grub2-secureboot-provide-linuxefi-config.patch
  * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch
  * grub2-secureboot-use-linuxefi-on-uefi.patch
- Rediff
  * grub2-btrfs-05-grub2-mkconfig.patch
  * grub2-efi-xen-cmdline.patch
  * grub2-s390x-05-grub2-mkconfig.patch
  * grub2-suse-remove-linux-root-param.patch</changelog>
  <changelog author="mchang@suse.com" date="1675771200">- Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064)
  * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch</changelog>
  <changelog author="mchang@suse.com" date="1675857600">- Fix nvmf boot device setup (bsc#1207811)
  * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch</changelog>
  <changelog author="mchang@suse.com" date="1677067200">- Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024)
  * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch
  * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch
- Fix lpar got hung at grub after inactive migration (bsc#1207684)
  * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch</changelog>
  <changelog author="glin@suse.com" date="1677153600">- Move unsupported zfs modules into 'extras' packages
  (bsc#1205554) (PED-2947)</changelog>
  <changelog author="mchang@suse.com" date="1677844800">- Make grub more robust against storage race condition causing system boot
  failures (bsc#1189036)
  * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch</changelog>
  <changelog author="mchang@suse.com" date="1679572800">- Fix aarch64 kiwi image's file not found due to '/@' prepended to path in
  btrfs filesystem. (bsc#1209165)
  * grub2-btrfs-05-grub2-mkconfig.patch</changelog>
  <changelog author="mchang@suse.com" date="1680782400">- Fix installation over serial console ends up in infinite boot loop
  (bsc#1187810) (bsc#1209667) (bsc#1209372)
  * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch</changelog>
  <changelog author="mchang@suse.com" date="1681214400">- Resolve some issues with OS boot failure on PPC NVMe-oF disks and made
  enhancements to PPC secure boot's root device discovery config (bsc#1207230)
- Ensure get_devargs and get_devname functions are consistent
  * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch
- Fix regex for Open Firmware device specifier with encoded commas
  * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch
- Fix regular expression in PPC secure boot config to prevent escaped commas
  from being treated as delimiters when retrieving partition substrings.
- Use prep_load_env in PPC secure boot config to handle unset host-specific
  environment variables and ensure successful command execution.
  * 0004-Introduce-prep_load_env-command.patch
- Refreshed
  * 0005-export-environment-at-start-up.patch</changelog>
  <changelog author="mchang@suse.com" date="1681819200">- Fix no prep partition error on non-PReP architectures by making the
  prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489)
  * 0004-Introduce-prep_load_env-command.patch
- Fix the issue of freeing an uninitialized pointer
  * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch
- Rediff
  * 0005-export-environment-at-start-up.patch</changelog>
  <changelog author="mchang@suse.com" date="1682078400">- Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581)
  * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch
  * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch</changelog>
  <changelog author="mchang@suse.com" date="1683201600">- grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563)</changelog>
  <changelog author="mchang@suse.com" date="1695211200">- Fix a boot delay regression in PowerPC PXE boot (bsc#1201300)
  * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch</changelog>
  <changelog author="mchang@suse.com" date="1696593600">- Fix CVE-2023-4692 (bsc#1215935)
- Fix CVE-2023-4693 (bsc#1215936)
  * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch
  * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch
  * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch
  * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch
  * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch
  * 0006-fs-ntfs-Make-code-more-readable.patch
- Bump upstream SBAT generation to 4</changelog>
</package>
<package pkgid="61d8f4fd4aacca0b5c2c4c04af3bd1a5ab652036b12a4b639e39eb37a9b2e41b" name="grub2-arm64-efi" arch="noarch">
  <version epoch="0" ver="2.06" rel="150500.29.8.1"/>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1666958400">- NVMeoFC support on grub (jsc#PED-996)
  * 0001-ieee1275-add-support-for-NVMeoFC.patch
  * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch
  * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch
  * 0004-ofpath-controller-name-update.patch
- TDX: Enhance grub2 measurement to TD RTMR (jsc#PED-1265)
  * 0001-commands-efi-tpm-Refine-the-status-of-log-event.patch
  * 0002-commands-efi-tpm-Use-grub_strcpy-instead-of-grub_mem.patch
  * 0003-efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch
- Measure the kernel on POWER10 and extend TPM PCRs (PED-1990)
  * 0001-ibmvtpm-Add-support-for-trusted-boot-using-a-vTPM-2..patch
  * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
  <changelog author="mchang@suse.com" date="1669118400">- Support grub2-install on LUKS2 encrypted device
  * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch
  * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch
  * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch</changelog>
  <changelog author="mchang@suse.com" date="1670241600">- Add tpm to signed grub.elf image (PED-1990) (bsc#1205912)
- Increase initial heap size from 1/4 to 1/3
  * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch</changelog>
  <changelog author="mchang@suse.com" date="1671451200">- Setup multiple device paths for a nvmf boot device (bsc#1205666)
  * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch</changelog>
  <changelog author="mchang@suse.com" date="1671796800">- Make grub.cfg invariant to efi and legacy platforms (bsc#1205200)
- Removed patch linuxefi
  * grub2-secureboot-provide-linuxefi-config.patch
  * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch
  * grub2-secureboot-use-linuxefi-on-uefi.patch
- Rediff
  * grub2-btrfs-05-grub2-mkconfig.patch
  * grub2-efi-xen-cmdline.patch
  * grub2-s390x-05-grub2-mkconfig.patch
  * grub2-suse-remove-linux-root-param.patch</changelog>
  <changelog author="mchang@suse.com" date="1675771200">- Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064)
  * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch</changelog>
  <changelog author="mchang@suse.com" date="1675857600">- Fix nvmf boot device setup (bsc#1207811)
  * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch</changelog>
  <changelog author="mchang@suse.com" date="1677067200">- Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024)
  * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch
  * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch
- Fix lpar got hung at grub after inactive migration (bsc#1207684)
  * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch</changelog>
  <changelog author="glin@suse.com" date="1677153600">- Move unsupported zfs modules into 'extras' packages
  (bsc#1205554) (PED-2947)</changelog>
  <changelog author="mchang@suse.com" date="1677844800">- Make grub more robust against storage race condition causing system boot
  failures (bsc#1189036)
  * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch</changelog>
  <changelog author="mchang@suse.com" date="1679572800">- Fix aarch64 kiwi image's file not found due to '/@' prepended to path in
  btrfs filesystem. (bsc#1209165)
  * grub2-btrfs-05-grub2-mkconfig.patch</changelog>
  <changelog author="mchang@suse.com" date="1680782400">- Fix installation over serial console ends up in infinite boot loop
  (bsc#1187810) (bsc#1209667) (bsc#1209372)
  * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch</changelog>
  <changelog author="mchang@suse.com" date="1681214400">- Resolve some issues with OS boot failure on PPC NVMe-oF disks and made
  enhancements to PPC secure boot's root device discovery config (bsc#1207230)
- Ensure get_devargs and get_devname functions are consistent
  * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch
- Fix regex for Open Firmware device specifier with encoded commas
  * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch
- Fix regular expression in PPC secure boot config to prevent escaped commas
  from being treated as delimiters when retrieving partition substrings.
- Use prep_load_env in PPC secure boot config to handle unset host-specific
  environment variables and ensure successful command execution.
  * 0004-Introduce-prep_load_env-command.patch
- Refreshed
  * 0005-export-environment-at-start-up.patch</changelog>
  <changelog author="mchang@suse.com" date="1681819200">- Fix no prep partition error on non-PReP architectures by making the
  prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489)
  * 0004-Introduce-prep_load_env-command.patch
- Fix the issue of freeing an uninitialized pointer
  * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch
- Rediff
  * 0005-export-environment-at-start-up.patch</changelog>
  <changelog author="mchang@suse.com" date="1682078400">- Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581)
  * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch
  * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch</changelog>
  <changelog author="mchang@suse.com" date="1683201600">- grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563)</changelog>
  <changelog author="mchang@suse.com" date="1695211200">- Fix a boot delay regression in PowerPC PXE boot (bsc#1201300)
  * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch</changelog>
  <changelog author="mchang@suse.com" date="1696593600">- Fix CVE-2023-4692 (bsc#1215935)
- Fix CVE-2023-4693 (bsc#1215936)
  * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch
  * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch
  * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch
  * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch
  * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch
  * 0006-fs-ntfs-Make-code-more-readable.patch
- Bump upstream SBAT generation to 4</changelog>
</package>
<package pkgid="e4675a06907138dcffad11e1b0e2a8362160643437802b5c2f768ca35d2920c6" name="grub2-i386-pc" arch="noarch">
  <version epoch="0" ver="2.06" rel="150500.29.8.1"/>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1666958400">- NVMeoFC support on grub (jsc#PED-996)
  * 0001-ieee1275-add-support-for-NVMeoFC.patch
  * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch
  * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch
  * 0004-ofpath-controller-name-update.patch
- TDX: Enhance grub2 measurement to TD RTMR (jsc#PED-1265)
  * 0001-commands-efi-tpm-Refine-the-status-of-log-event.patch
  * 0002-commands-efi-tpm-Use-grub_strcpy-instead-of-grub_mem.patch
  * 0003-efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch
- Measure the kernel on POWER10 and extend TPM PCRs (PED-1990)
  * 0001-ibmvtpm-Add-support-for-trusted-boot-using-a-vTPM-2..patch
  * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
  <changelog author="mchang@suse.com" date="1669118400">- Support grub2-install on LUKS2 encrypted device
  * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch
  * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch
  * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch</changelog>
  <changelog author="mchang@suse.com" date="1670241600">- Add tpm to signed grub.elf image (PED-1990) (bsc#1205912)
- Increase initial heap size from 1/4 to 1/3
  * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch</changelog>
  <changelog author="mchang@suse.com" date="1671451200">- Setup multiple device paths for a nvmf boot device (bsc#1205666)
  * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch</changelog>
  <changelog author="mchang@suse.com" date="1671796800">- Make grub.cfg invariant to efi and legacy platforms (bsc#1205200)
- Removed patch linuxefi
  * grub2-secureboot-provide-linuxefi-config.patch
  * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch
  * grub2-secureboot-use-linuxefi-on-uefi.patch
- Rediff
  * grub2-btrfs-05-grub2-mkconfig.patch
  * grub2-efi-xen-cmdline.patch
  * grub2-s390x-05-grub2-mkconfig.patch
  * grub2-suse-remove-linux-root-param.patch</changelog>
  <changelog author="mchang@suse.com" date="1675771200">- Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064)
  * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch</changelog>
  <changelog author="mchang@suse.com" date="1675857600">- Fix nvmf boot device setup (bsc#1207811)
  * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch</changelog>
  <changelog author="mchang@suse.com" date="1677067200">- Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024)
  * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch
  * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch
- Fix lpar got hung at grub after inactive migration (bsc#1207684)
  * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch</changelog>
  <changelog author="glin@suse.com" date="1677153600">- Move unsupported zfs modules into 'extras' packages
  (bsc#1205554) (PED-2947)</changelog>
  <changelog author="mchang@suse.com" date="1677844800">- Make grub more robust against storage race condition causing system boot
  failures (bsc#1189036)
  * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch</changelog>
  <changelog author="mchang@suse.com" date="1679572800">- Fix aarch64 kiwi image's file not found due to '/@' prepended to path in
  btrfs filesystem. (bsc#1209165)
  * grub2-btrfs-05-grub2-mkconfig.patch</changelog>
  <changelog author="mchang@suse.com" date="1680782400">- Fix installation over serial console ends up in infinite boot loop
  (bsc#1187810) (bsc#1209667) (bsc#1209372)
  * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch</changelog>
  <changelog author="mchang@suse.com" date="1681214400">- Resolve some issues with OS boot failure on PPC NVMe-oF disks and made
  enhancements to PPC secure boot's root device discovery config (bsc#1207230)
- Ensure get_devargs and get_devname functions are consistent
  * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch
- Fix regex for Open Firmware device specifier with encoded commas
  * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch
- Fix regular expression in PPC secure boot config to prevent escaped commas
  from being treated as delimiters when retrieving partition substrings.
- Use prep_load_env in PPC secure boot config to handle unset host-specific
  environment variables and ensure successful command execution.
  * 0004-Introduce-prep_load_env-command.patch
- Refreshed
  * 0005-export-environment-at-start-up.patch</changelog>
  <changelog author="mchang@suse.com" date="1681819200">- Fix no prep partition error on non-PReP architectures by making the
  prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489)
  * 0004-Introduce-prep_load_env-command.patch
- Fix the issue of freeing an uninitialized pointer
  * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch
- Rediff
  * 0005-export-environment-at-start-up.patch</changelog>
  <changelog author="mchang@suse.com" date="1682078400">- Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581)
  * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch
  * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch</changelog>
  <changelog author="mchang@suse.com" date="1683201600">- grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563)</changelog>
  <changelog author="mchang@suse.com" date="1695211200">- Fix a boot delay regression in PowerPC PXE boot (bsc#1201300)
  * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch</changelog>
  <changelog author="mchang@suse.com" date="1696593600">- Fix CVE-2023-4692 (bsc#1215935)
- Fix CVE-2023-4693 (bsc#1215936)
  * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch
  * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch
  * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch
  * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch
  * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch
  * 0006-fs-ntfs-Make-code-more-readable.patch
- Bump upstream SBAT generation to 4</changelog>
</package>
<package pkgid="0eed197b9aae2a903e61bb5c6b86c503ae5872c3500cbfae8633fa2805ca35a8" name="grub2-s390x-emu" arch="s390x">
  <version epoch="0" ver="2.06" rel="150500.29.8.1"/>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1666958400">- NVMeoFC support on grub (jsc#PED-996)
  * 0001-ieee1275-add-support-for-NVMeoFC.patch
  * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch
  * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch
  * 0004-ofpath-controller-name-update.patch
- TDX: Enhance grub2 measurement to TD RTMR (jsc#PED-1265)
  * 0001-commands-efi-tpm-Refine-the-status-of-log-event.patch
  * 0002-commands-efi-tpm-Use-grub_strcpy-instead-of-grub_mem.patch
  * 0003-efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch
- Measure the kernel on POWER10 and extend TPM PCRs (PED-1990)
  * 0001-ibmvtpm-Add-support-for-trusted-boot-using-a-vTPM-2..patch
  * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
  <changelog author="mchang@suse.com" date="1669118400">- Support grub2-install on LUKS2 encrypted device
  * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch
  * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch
  * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch</changelog>
  <changelog author="mchang@suse.com" date="1670241600">- Add tpm to signed grub.elf image (PED-1990) (bsc#1205912)
- Increase initial heap size from 1/4 to 1/3
  * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch</changelog>
  <changelog author="mchang@suse.com" date="1671451200">- Setup multiple device paths for a nvmf boot device (bsc#1205666)
  * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch</changelog>
  <changelog author="mchang@suse.com" date="1671796800">- Make grub.cfg invariant to efi and legacy platforms (bsc#1205200)
- Removed patch linuxefi
  * grub2-secureboot-provide-linuxefi-config.patch
  * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch
  * grub2-secureboot-use-linuxefi-on-uefi.patch
- Rediff
  * grub2-btrfs-05-grub2-mkconfig.patch
  * grub2-efi-xen-cmdline.patch
  * grub2-s390x-05-grub2-mkconfig.patch
  * grub2-suse-remove-linux-root-param.patch</changelog>
  <changelog author="mchang@suse.com" date="1675771200">- Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064)
  * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch</changelog>
  <changelog author="mchang@suse.com" date="1675857600">- Fix nvmf boot device setup (bsc#1207811)
  * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch</changelog>
  <changelog author="mchang@suse.com" date="1677067200">- Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024)
  * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch
  * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch
- Fix lpar got hung at grub after inactive migration (bsc#1207684)
  * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch</changelog>
  <changelog author="glin@suse.com" date="1677153600">- Move unsupported zfs modules into 'extras' packages
  (bsc#1205554) (PED-2947)</changelog>
  <changelog author="mchang@suse.com" date="1677844800">- Make grub more robust against storage race condition causing system boot
  failures (bsc#1189036)
  * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch</changelog>
  <changelog author="mchang@suse.com" date="1679572800">- Fix aarch64 kiwi image's file not found due to '/@' prepended to path in
  btrfs filesystem. (bsc#1209165)
  * grub2-btrfs-05-grub2-mkconfig.patch</changelog>
  <changelog author="mchang@suse.com" date="1680782400">- Fix installation over serial console ends up in infinite boot loop
  (bsc#1187810) (bsc#1209667) (bsc#1209372)
  * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch</changelog>
  <changelog author="mchang@suse.com" date="1681214400">- Resolve some issues with OS boot failure on PPC NVMe-oF disks and made
  enhancements to PPC secure boot's root device discovery config (bsc#1207230)
- Ensure get_devargs and get_devname functions are consistent
  * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch
- Fix regex for Open Firmware device specifier with encoded commas
  * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch
- Fix regular expression in PPC secure boot config to prevent escaped commas
  from being treated as delimiters when retrieving partition substrings.
- Use prep_load_env in PPC secure boot config to handle unset host-specific
  environment variables and ensure successful command execution.
  * 0004-Introduce-prep_load_env-command.patch
- Refreshed
  * 0005-export-environment-at-start-up.patch</changelog>
  <changelog author="mchang@suse.com" date="1681819200">- Fix no prep partition error on non-PReP architectures by making the
  prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489)
  * 0004-Introduce-prep_load_env-command.patch
- Fix the issue of freeing an uninitialized pointer
  * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch
- Rediff
  * 0005-export-environment-at-start-up.patch</changelog>
  <changelog author="mchang@suse.com" date="1682078400">- Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581)
  * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch
  * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch</changelog>
  <changelog author="mchang@suse.com" date="1683201600">- grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563)</changelog>
  <changelog author="mchang@suse.com" date="1695211200">- Fix a boot delay regression in PowerPC PXE boot (bsc#1201300)
  * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch</changelog>
  <changelog author="mchang@suse.com" date="1696593600">- Fix CVE-2023-4692 (bsc#1215935)
- Fix CVE-2023-4693 (bsc#1215936)
  * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch
  * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch
  * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch
  * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch
  * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch
  * 0006-fs-ntfs-Make-code-more-readable.patch
- Bump upstream SBAT generation to 4</changelog>
</package>
<package pkgid="812cf04648769b5c4c3b942f2e644916d9fbed488d3d212094c1b0333df88d34" name="grub2-snapper-plugin" arch="noarch">
  <version epoch="0" ver="2.06" rel="150500.29.8.1"/>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1666958400">- NVMeoFC support on grub (jsc#PED-996)
  * 0001-ieee1275-add-support-for-NVMeoFC.patch
  * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch
  * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch
  * 0004-ofpath-controller-name-update.patch
- TDX: Enhance grub2 measurement to TD RTMR (jsc#PED-1265)
  * 0001-commands-efi-tpm-Refine-the-status-of-log-event.patch
  * 0002-commands-efi-tpm-Use-grub_strcpy-instead-of-grub_mem.patch
  * 0003-efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch
- Measure the kernel on POWER10 and extend TPM PCRs (PED-1990)
  * 0001-ibmvtpm-Add-support-for-trusted-boot-using-a-vTPM-2..patch
  * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
  <changelog author="mchang@suse.com" date="1669118400">- Support grub2-install on LUKS2 encrypted device
  * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch
  * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch
  * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch</changelog>
  <changelog author="mchang@suse.com" date="1670241600">- Add tpm to signed grub.elf image (PED-1990) (bsc#1205912)
- Increase initial heap size from 1/4 to 1/3
  * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch</changelog>
  <changelog author="mchang@suse.com" date="1671451200">- Setup multiple device paths for a nvmf boot device (bsc#1205666)
  * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch</changelog>
  <changelog author="mchang@suse.com" date="1671796800">- Make grub.cfg invariant to efi and legacy platforms (bsc#1205200)
- Removed patch linuxefi
  * grub2-secureboot-provide-linuxefi-config.patch
  * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch
  * grub2-secureboot-use-linuxefi-on-uefi.patch
- Rediff
  * grub2-btrfs-05-grub2-mkconfig.patch
  * grub2-efi-xen-cmdline.patch
  * grub2-s390x-05-grub2-mkconfig.patch
  * grub2-suse-remove-linux-root-param.patch</changelog>
  <changelog author="mchang@suse.com" date="1675771200">- Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064)
  * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch</changelog>
  <changelog author="mchang@suse.com" date="1675857600">- Fix nvmf boot device setup (bsc#1207811)
  * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch</changelog>
  <changelog author="mchang@suse.com" date="1677067200">- Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024)
  * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch
  * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch
- Fix lpar got hung at grub after inactive migration (bsc#1207684)
  * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch</changelog>
  <changelog author="glin@suse.com" date="1677153600">- Move unsupported zfs modules into 'extras' packages
  (bsc#1205554) (PED-2947)</changelog>
  <changelog author="mchang@suse.com" date="1677844800">- Make grub more robust against storage race condition causing system boot
  failures (bsc#1189036)
  * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch</changelog>
  <changelog author="mchang@suse.com" date="1679572800">- Fix aarch64 kiwi image's file not found due to '/@' prepended to path in
  btrfs filesystem. (bsc#1209165)
  * grub2-btrfs-05-grub2-mkconfig.patch</changelog>
  <changelog author="mchang@suse.com" date="1680782400">- Fix installation over serial console ends up in infinite boot loop
  (bsc#1187810) (bsc#1209667) (bsc#1209372)
  * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch</changelog>
  <changelog author="mchang@suse.com" date="1681214400">- Resolve some issues with OS boot failure on PPC NVMe-oF disks and made
  enhancements to PPC secure boot's root device discovery config (bsc#1207230)
- Ensure get_devargs and get_devname functions are consistent
  * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch
- Fix regex for Open Firmware device specifier with encoded commas
  * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch
- Fix regular expression in PPC secure boot config to prevent escaped commas
  from being treated as delimiters when retrieving partition substrings.
- Use prep_load_env in PPC secure boot config to handle unset host-specific
  environment variables and ensure successful command execution.
  * 0004-Introduce-prep_load_env-command.patch
- Refreshed
  * 0005-export-environment-at-start-up.patch</changelog>
  <changelog author="mchang@suse.com" date="1681819200">- Fix no prep partition error on non-PReP architectures by making the
  prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489)
  * 0004-Introduce-prep_load_env-command.patch
- Fix the issue of freeing an uninitialized pointer
  * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch
- Rediff
  * 0005-export-environment-at-start-up.patch</changelog>
  <changelog author="mchang@suse.com" date="1682078400">- Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581)
  * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch
  * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch</changelog>
  <changelog author="mchang@suse.com" date="1683201600">- grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563)</changelog>
  <changelog author="mchang@suse.com" date="1695211200">- Fix a boot delay regression in PowerPC PXE boot (bsc#1201300)
  * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch</changelog>
  <changelog author="mchang@suse.com" date="1696593600">- Fix CVE-2023-4692 (bsc#1215935)
- Fix CVE-2023-4693 (bsc#1215936)
  * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch
  * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch
  * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch
  * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch
  * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch
  * 0006-fs-ntfs-Make-code-more-readable.patch
- Bump upstream SBAT generation to 4</changelog>
</package>
<package pkgid="b0b3ec2e850805fc7685231b8a7ab92fbefb5ce7d9e182eb381df41a7aad5f0f" name="grub2-x86_64-efi" arch="noarch">
  <version epoch="0" ver="2.06" rel="150500.29.8.1"/>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1666958400">- NVMeoFC support on grub (jsc#PED-996)
  * 0001-ieee1275-add-support-for-NVMeoFC.patch
  * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch
  * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch
  * 0004-ofpath-controller-name-update.patch
- TDX: Enhance grub2 measurement to TD RTMR (jsc#PED-1265)
  * 0001-commands-efi-tpm-Refine-the-status-of-log-event.patch
  * 0002-commands-efi-tpm-Use-grub_strcpy-instead-of-grub_mem.patch
  * 0003-efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch
- Measure the kernel on POWER10 and extend TPM PCRs (PED-1990)
  * 0001-ibmvtpm-Add-support-for-trusted-boot-using-a-vTPM-2..patch
  * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
  <changelog author="mchang@suse.com" date="1669118400">- Support grub2-install on LUKS2 encrypted device
  * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch
  * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch
  * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch</changelog>
  <changelog author="mchang@suse.com" date="1670241600">- Add tpm to signed grub.elf image (PED-1990) (bsc#1205912)
- Increase initial heap size from 1/4 to 1/3
  * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch</changelog>
  <changelog author="mchang@suse.com" date="1671451200">- Setup multiple device paths for a nvmf boot device (bsc#1205666)
  * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch</changelog>
  <changelog author="mchang@suse.com" date="1671796800">- Make grub.cfg invariant to efi and legacy platforms (bsc#1205200)
- Removed patch linuxefi
  * grub2-secureboot-provide-linuxefi-config.patch
  * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch
  * grub2-secureboot-use-linuxefi-on-uefi.patch
- Rediff
  * grub2-btrfs-05-grub2-mkconfig.patch
  * grub2-efi-xen-cmdline.patch
  * grub2-s390x-05-grub2-mkconfig.patch
  * grub2-suse-remove-linux-root-param.patch</changelog>
  <changelog author="mchang@suse.com" date="1675771200">- Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064)
  * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch</changelog>
  <changelog author="mchang@suse.com" date="1675857600">- Fix nvmf boot device setup (bsc#1207811)
  * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch</changelog>
  <changelog author="mchang@suse.com" date="1677067200">- Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024)
  * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch
  * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch
- Fix lpar got hung at grub after inactive migration (bsc#1207684)
  * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch</changelog>
  <changelog author="glin@suse.com" date="1677153600">- Move unsupported zfs modules into 'extras' packages
  (bsc#1205554) (PED-2947)</changelog>
  <changelog author="mchang@suse.com" date="1677844800">- Make grub more robust against storage race condition causing system boot
  failures (bsc#1189036)
  * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch</changelog>
  <changelog author="mchang@suse.com" date="1679572800">- Fix aarch64 kiwi image's file not found due to '/@' prepended to path in
  btrfs filesystem. (bsc#1209165)
  * grub2-btrfs-05-grub2-mkconfig.patch</changelog>
  <changelog author="mchang@suse.com" date="1680782400">- Fix installation over serial console ends up in infinite boot loop
  (bsc#1187810) (bsc#1209667) (bsc#1209372)
  * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch</changelog>
  <changelog author="mchang@suse.com" date="1681214400">- Resolve some issues with OS boot failure on PPC NVMe-oF disks and made
  enhancements to PPC secure boot's root device discovery config (bsc#1207230)
- Ensure get_devargs and get_devname functions are consistent
  * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch
- Fix regex for Open Firmware device specifier with encoded commas
  * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch
- Fix regular expression in PPC secure boot config to prevent escaped commas
  from being treated as delimiters when retrieving partition substrings.
- Use prep_load_env in PPC secure boot config to handle unset host-specific
  environment variables and ensure successful command execution.
  * 0004-Introduce-prep_load_env-command.patch
- Refreshed
  * 0005-export-environment-at-start-up.patch</changelog>
  <changelog author="mchang@suse.com" date="1681819200">- Fix no prep partition error on non-PReP architectures by making the
  prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489)
  * 0004-Introduce-prep_load_env-command.patch
- Fix the issue of freeing an uninitialized pointer
  * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch
- Rediff
  * 0005-export-environment-at-start-up.patch</changelog>
  <changelog author="mchang@suse.com" date="1682078400">- Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581)
  * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch
  * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch</changelog>
  <changelog author="mchang@suse.com" date="1683201600">- grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563)</changelog>
  <changelog author="mchang@suse.com" date="1695211200">- Fix a boot delay regression in PowerPC PXE boot (bsc#1201300)
  * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch</changelog>
  <changelog author="mchang@suse.com" date="1696593600">- Fix CVE-2023-4692 (bsc#1215935)
- Fix CVE-2023-4693 (bsc#1215936)
  * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch
  * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch
  * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch
  * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch
  * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch
  * 0006-fs-ntfs-Make-code-more-readable.patch
- Bump upstream SBAT generation to 4</changelog>
</package>
<package pkgid="ef559f657f2337593e5823d8da014bd3ca2f18774481361fae2e073886accf29" name="grub2-x86_64-xen" arch="noarch">
  <version epoch="0" ver="2.06" rel="150500.29.8.1"/>
  <changelog author="mchang@suse.com" date="1666612800">- Include loopback into signed grub2 image (jsc#PED-2150)</changelog>
  <changelog author="mchang@suse.com" date="1666958400">- NVMeoFC support on grub (jsc#PED-996)
  * 0001-ieee1275-add-support-for-NVMeoFC.patch
  * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch
  * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch
  * 0004-ofpath-controller-name-update.patch
- TDX: Enhance grub2 measurement to TD RTMR (jsc#PED-1265)
  * 0001-commands-efi-tpm-Refine-the-status-of-log-event.patch
  * 0002-commands-efi-tpm-Use-grub_strcpy-instead-of-grub_mem.patch
  * 0003-efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch
- Measure the kernel on POWER10 and extend TPM PCRs (PED-1990)
  * 0001-ibmvtpm-Add-support-for-trusted-boot-using-a-vTPM-2..patch
  * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch</changelog>
  <changelog author="mchang@suse.com" date="1667563200">- Security fixes and hardenings
  * 0001-font-Reject-glyphs-exceeds-font-max_glyph_width-or-f.patch
  * 0002-font-Fix-size-overflow-in-grub_font_get_glyph_intern.patch
- Fix CVE-2022-2601 (bsc#1205178)
  * 0003-font-Fix-several-integer-overflows-in-grub_font_cons.patch
  * 0004-font-Remove-grub_font_dup_glyph.patch
  * 0005-font-Fix-integer-overflow-in-ensure_comb_space.patch
  * 0006-font-Fix-integer-overflow-in-BMP-index.patch
  * 0007-font-Fix-integer-underflow-in-binary-search-of-char-.patch
  * 0008-fbutil-Fix-integer-overflow.patch
- Fix CVE-2022-3775 (bsc#1205182)
  * 0009-font-Fix-an-integer-underflow-in-blit_comb.patch
  * 0010-font-Harden-grub_font_blit_glyph-and-grub_font_blit_.patch
  * 0011-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
  * 0012-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
- Bump upstream SBAT generation to 3</changelog>
  <changelog author="mchang@suse.com" date="1669118400">- Support grub2-install on LUKS2 encrypted device
  * 0001-devmapper-getroot-Have-devmapper-recognize-LUKS2.patch
  * 0002-devmapper-getroot-Set-up-cheated-LUKS2-cryptodisk-mo.patch
  * 0003-disk-cryptodisk-When-cheatmounting-use-the-sector-in.patch</changelog>
  <changelog author="mchang@suse.com" date="1670241600">- Add tpm to signed grub.elf image (PED-1990) (bsc#1205912)
- Increase initial heap size from 1/4 to 1/3
  * 0001-ieee1275-Increase-initially-allocated-heap-from-1-4-.patch</changelog>
  <changelog author="mchang@suse.com" date="1671451200">- Setup multiple device paths for a nvmf boot device (bsc#1205666)
  * 0001-grub2-Set-multiple-device-path-for-a-nvmf-boot-devic.patch</changelog>
  <changelog author="mchang@suse.com" date="1671796800">- Make grub.cfg invariant to efi and legacy platforms (bsc#1205200)
- Removed patch linuxefi
  * grub2-secureboot-provide-linuxefi-config.patch
  * grub2-secureboot-use-linuxefi-on-uefi-in-os-prober.patch
  * grub2-secureboot-use-linuxefi-on-uefi.patch
- Rediff
  * grub2-btrfs-05-grub2-mkconfig.patch
  * grub2-efi-xen-cmdline.patch
  * grub2-s390x-05-grub2-mkconfig.patch
  * grub2-suse-remove-linux-root-param.patch</changelog>
  <changelog author="mchang@suse.com" date="1675771200">- Fix unknown filesystem error on disks with 4096 sector size (bsc#1207064)
  * 0001-grub-core-modify-sector-by-sysfs-as-disk-sector.patch</changelog>
  <changelog author="mchang@suse.com" date="1675857600">- Fix nvmf boot device setup (bsc#1207811)
  * 0001-grub2-Can-t-setup-a-default-boot-device-correctly-on.patch</changelog>
  <changelog author="mchang@suse.com" date="1677067200">- Fix out of memory error on lpar installation from virtual cdrom (bsc#1208024)
  * 0001-ieee1275-Further-increase-initially-allocated-heap-f.patch
  * 0002-tpm-Disable-tpm-verifier-if-tpm-is-not-present.patch
- Fix lpar got hung at grub after inactive migration (bsc#1207684)
  * 0002-ieee1275-implement-vec5-for-cas-negotiation.patch</changelog>
  <changelog author="glin@suse.com" date="1677153600">- Move unsupported zfs modules into 'extras' packages
  (bsc#1205554) (PED-2947)</changelog>
  <changelog author="mchang@suse.com" date="1677844800">- Make grub more robust against storage race condition causing system boot
  failures (bsc#1189036)
  * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch</changelog>
  <changelog author="mchang@suse.com" date="1679572800">- Fix aarch64 kiwi image's file not found due to '/@' prepended to path in
  btrfs filesystem. (bsc#1209165)
  * grub2-btrfs-05-grub2-mkconfig.patch</changelog>
  <changelog author="mchang@suse.com" date="1680782400">- Fix installation over serial console ends up in infinite boot loop
  (bsc#1187810) (bsc#1209667) (bsc#1209372)
  * 0001-Fix-infinite-boot-loop-on-headless-system-in-qemu.patch</changelog>
  <changelog author="mchang@suse.com" date="1681214400">- Resolve some issues with OS boot failure on PPC NVMe-oF disks and made
  enhancements to PPC secure boot's root device discovery config (bsc#1207230)
- Ensure get_devargs and get_devname functions are consistent
  * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch
- Fix regex for Open Firmware device specifier with encoded commas
  * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch
- Fix regular expression in PPC secure boot config to prevent escaped commas
  from being treated as delimiters when retrieving partition substrings.
- Use prep_load_env in PPC secure boot config to handle unset host-specific
  environment variables and ensure successful command execution.
  * 0004-Introduce-prep_load_env-command.patch
- Refreshed
  * 0005-export-environment-at-start-up.patch</changelog>
  <changelog author="mchang@suse.com" date="1681819200">- Fix no prep partition error on non-PReP architectures by making the
  prep_loadenv module exclusive to powerpc_ieee1275 platform (bsc#1210489)
  * 0004-Introduce-prep_load_env-command.patch
- Fix the issue of freeing an uninitialized pointer
  * 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch
- Rediff
  * 0005-export-environment-at-start-up.patch</changelog>
  <changelog author="mchang@suse.com" date="1682078400">- Fix PowerVS deployment fails to boot with 90 cores (bsc#1208581)
  * 0001-kern-ieee1275-init-Convert-plain-numbers-to-constant.patch
  * 0002-kern-ieee1275-init-Extended-support-in-Vec5.patch</changelog>
  <changelog author="mchang@suse.com" date="1683201600">- grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563)</changelog>
  <changelog author="mchang@suse.com" date="1695211200">- Fix a boot delay regression in PowerPC PXE boot (bsc#1201300)
  * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch</changelog>
  <changelog author="mchang@suse.com" date="1696593600">- Fix CVE-2023-4692 (bsc#1215935)
- Fix CVE-2023-4693 (bsc#1215936)
  * 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch
  * 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch
  * 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch
  * 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch
  * 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch
  * 0006-fs-ntfs-Make-code-more-readable.patch
- Bump upstream SBAT generation to 4</changelog>
</package>
<package pkgid="aa68f2cb800a71059f5545dd42bceb3925c375d4a8546418ad9e7cfafccab5c4" name="harfbuzz" arch="src">
  <version epoch="0" ver="3.4.0" rel="150400.3.8.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1591185600">- Update to version 2.6.7:
  + Update to Unicode 13.0.0
  + Fix hb_ot_layout_get_ligature_carets for fonts without lcar
    table
- includes fixes from 2.6.6:
  * A fix in AAT kerning for Geeza Pro</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1592913600">- update to 2.6.8:
  + New API to fetch glyph alternates from GSUB table
  + New API +hb_ot_layout_lookup_get_glyph_alternates()
- Drop gpg2 BuildRequires and stop verifying signature during
  build: upstream no longer signs the tarball/signature.</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- Update to version 2.7.2:
  + Fix a regression in the previous release that caused a crash
    with Kaithi.
  + More OOM fixes.
  + ot-funcs now handles variable empty glyphs better when
    hvar/vvar isn't present.
  + Reverted a GDEF processing regression.
  + A couple of fixes to handle OOM better.
  + Use an implementation for round that always rounds up, some
    minor fluctuations are expected on var font specially when
    hb-ot callback is used.
  + Fix an AAT's `kerx` issue on broken rendering of Devanagari
    Sangam MN.
  + Remove AAT's `lcar` table support from _get_ligature_carets
    API, not even much use on macOS installed fonts (only two
    files). GDEF support is the recommended one and expected to
    work properly after issues fixed two releases ago.
  - Minor memory fixes to handle OOM better specially in hb-ft.
  - Minor .so files versioning scheme change and remove
    stable/unstable scheme differences, was never used in practice
    (always default to stable scheme).
  - We are now suggesting careful packaging of the library using
    meson, https://github.com/harfbuzz/harfbuzz/wiki/Notes-on-migration-to-meson
    for more information.
  - Distribution package URL is changed, either use GitHub
    generated tarballs,
    `https://github.com/harfbuzz/harfbuzz/archive/$pkgver.tar.gz`
    or, even more preferably use commit hash of the release and git
    checkouts like,
    `git+https://github.com/harfbuzz/harfbuzz#commit=$commit`</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1609070400">- Update to version 2.7.4:
  + Fix missing --enable-introspection configure option
- Changes from version 2.7.3:
  + Update USE shaper to 2020-08-13 specification, and other
    improvements
  + Don’t disable liga feature in myanmar shaper, to match
    Uniscribe
  + Improvements to language and script tags handling.
  + Update language system tag registry to OpenType 1.8.4
  + Support for serializing and deserializing Unicode buffers
  + Increase buffer work limits to handle fonts with many complex
    lookups
  + Handle more shaping operations in trace output
  + Memory access fixes
  + More OOM fixes
  + Improved documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610107200">- Switch to meson buildsystem:
  + Add meson BuildRequires and macros.
  + Replace gcc-c++ for generic c++_compiler BuildRequires.
  + Add meson_test macro in check section, run tests during build.
  + Drop pkgconfig(graphite2) BuildRequires: No longer build
    graphite2 support, following upstream that disables this by
    default.
  + Stop packaging gtk-docs, pass -Ddocs=disabled to meson, this
    way we might avoid a build-cycle and since we did not have a
    explicit docs subpackage, just silently drop them.</changelog>
  <changelog author="dimstar@opensuse.org" date="1610539200">- Re-enable graphite2 support: TexLive relies on this to be
  present:
  + Pass -Dgraphite=enabled to meson.
  + Add pkgconfig(graphite2) BuildRequires.</changelog>
  <changelog author="christophe@krop.fr" date="1618315200">- Update to version 2.8.0:
  + Shape joining scripts other than Arabic/Syriac using the
    Universal Shaping Engine. Previously these were shaped using
    the generalized Arabic shaper.
  + Fix regression in shaping of U+0B55 ORIYA SIGN OVERLINE.
  + Update language tags.
  + Variations: reduce error: do not round each interpolated delta.
  + Documentation improvements.
  + Subsetter improvements: subsets most, if not all, lookup types
    now.
  + Fuzzer-found fixes and other improvements when memory failures
    happen.
  + Removed most atomic implementations now that we have C++11
    atomic impl.
  + General codebase upkeep; using more C++11 features: constexpr
    constructors, etc.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1620302400">- Update to version 2.8.1:
  + Subsetter now fully supports GSUB/GPOS/GDEF tables (including
    variations); as such, layout tables are retained by subsetter
    by default
  + hb-view supports iTerm2 and kitty inline image protocols
    it can also use Chafa for terminal graphics if available
- Add  pkgconfig(chafa): new, optional depdency.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1626264000">- Update to version 2.8.2:
  + Shaping LTR digits for RTL scripts now makes the native
    direction of the digits LTR, applying shaping and positioning
    rules on the same glyph order as Uniscribe
  + Subsetting COLR v1 and CPAL tables is now supported
  + Various fixes and improvements to the subsetter
  + When applying morx table, mark glyph widths should not be zeroed
  + GPOS is preferred over kerx, if GSUB was applied
  + Regional_Indicator pairs are grouped together when clustering</changelog>
  <changelog author="dimstar@opensuse.org" date="1626523200">- Drop pkgconfig(chafa) BuildRequires for now: causes a cycle
  between chafa and harfbuzz, and disable it in meson</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1631448000">- harfbuzz 2.9.1:
  + Subsetter API close to stable
  + Various fuzzer-found bug fixes
  + hb_buffer_append() now handles the pre- and post-context which
    previously were left unchanged in the destination buffer
  + hb-view / hb-shape now accept following new arguments:
  - -unicodes: takes a list of hex numbers that represent Unicode
    codepoints.
  + Undeprecated API: hb_set_invert()
- includes changes from 2.9.0:
  + Support multiple variation axes with same tag, aka HOI
  + The coretext testing shaper now passes font variations to
    CoreText
  + hb-shape/hb-view does not break line at new lines unless text
    is read from file
  + hb-view and hb-subset has a --batch now, similar to hb-shape
  + The --batch mode now uses ; as argument separator instead of :
    used previously
  + The --batch in hb-shape does not expect 0th argument anymore.
    That is, the lines read are interpreted as argv[1:], instead
    of argv[0:].
  + The --batch option has been undocumented. We are ready to
    document it; send feedback if you find it useful
  + hb-subset got arguments revamps. Added much-requested
  - -gids-file, --glyphs, --glyphs-file, --unicodes-file,
    supporting ranges in --unicodes.
  + Various bug fixes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1631966400">- harfbuzz 3.0.0:
  + Unicode 14.0 support
  + hb-subset API and harfbuzz-subset ABI now declared stable
  + hb-style API is now stable</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636200000">- harfbuzz 3.1.0:
  * Better offset-overflow handling in the subsetter library
  * Improved Unicode 14 properties in the USE shaper, and various
    other USE shaper fixes
  * MATH and COLR v1 tables subsetting support, and various other
    subsetter fixes
  * Support for Pwo Karen / Ason Chin medial la. (Simon Cozens)
  * Apply GPOS positioning when substituting with morx table, if
    kerx is missing
  * Apply calt and clig features across syllable boundaries in
    Indic shaper
  * Meson option for enabling Graphite 2 has been renamed to
    graphite2
  * Build and documentation fixes
- add harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636459200">- Update to version 3.1.1:
  + Work around GCC cast-align error/warning on some platforms.
  + Documentation improvements.
- Drop patch fixed upstream:
  + harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1639742400">- Update to 3.1.2:
  + hb-shape / hb-view: revert treating text on the commandline as
    single paragraph (was introduced in 3.0.0); add new
  - -single-par to do that
  + Subsetter bug fixes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1639742401">- Update to 3.2.0:
  + Fixed shaping of Apple Color Emoji flags in right-to-left context
  + Fixed positioning of CFF fonts in HB_TINY profile
  + OpenType 1.9 language tags update
  + Add HB_NO_VERTICAL config option
  + Add HB_CONFIG_OVERRIDE_H for easier configuration
  + Improved packing of cmap, loca, and Ligature tables
  + Significantly improved overflow-resolution strategy in the repacker</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1644235200">- update to 3.3.2:
  + Revert splitting of pair positioning values introduced in 3.3.0
    as it proved problematic
- includes changes from 3.3.1:
  + Fix heap-use-after-free in harfbuzz-subset introduced in
    previous release
- includes changes from 3.3.0:
  + Improved documentation, code cleanup
  + The low 16-bits of face index will be used by hb_face_create()
    to select a face inside a font collection file format, while the
    high 16-bits will be used by hb_font_create() to load the named
    instance
  + Glyph positions and other font metrics now apply synthetic slant
    set by hb_font_set_synthetic_slant(), for improved positioning
    for synthetically slanted fonts
  + Fixed unintentional locale dependency in hb_variation_to_string()
    for decimal point representation
  + When applying pair positioning (kerning) the positioning value
    is split between the two sides of the pair for improved cursor
    positioning between such pairs
  + Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in
    conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing
    re-shaping during line breaking. Check the documentation for
    further details
  + Improved handling of macrolanguages when mapping BCP 47 codes
    to OpenType tags</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1644753600">- update to 3.4.0:
  + Perform sanity checks on shaping results is now part of
    “harfbuzz” library and can be enabled by setting the buffer
    flag HB_BUFFER_FLAG_VERIFY
  + Arabic Mark Transient Reordering Algorithm have been updated
    to revision 6
  + ISO 15924 code for mathematical notation, ‘Zmth’, now maps to
    the OpenType ‘math’ tag
  + It is now possible to get at once all math kerning values for a
    given glyph at a given corner
  + Fix locale_t portability issues on systems the typedef’s it to
    a void pointer</changelog>
  <changelog author="mgorse@suse.com" date="1658836800">- Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents
  (boo#1200900 CVE-2022-33068).</changelog>
  <changelog author="mgorse@suse.com" date="1680696000">- Add CVE-2023-25193.patch: limit how far we skip when looking
  back (bsc#1207922 CVE-2023-25193).</changelog>
</package>
<package pkgid="9df42ff1d31cee4d9ea54904d4660fa36096dd0ae1e9d007f8d7c2c4e72d449a" name="hidapi" arch="src">
  <version epoch="0" ver="0.10.1" rel="150300.3.2.1"/>
  <changelog author="matwey.kornilov@gmail.com" date="1390824000">- Initial version</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1394798400">- Add do_not_install_docs.patch: don't let make install docs</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1395662400">- Supply LICENSE files with libraries</changelog>
  <changelog author="luca@z3ntu.xyz" date="1563796800">- Update to 0.9.0
- Switch upstream to libusb/hidapi because the original maintainer is not active anymore</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1563796801">- Use disabled services to follow Factory guidelines.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(libudev) instead of libudev-devel: allow
  OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="jgwang@suse.com" date="1610366400">- Update to version 0.10.1
  * Add FreeBSD/macOS/MinGW/Alpine/Arch Linux/Windows CI
  * Add hid_version/hid_version_str API (#192)
  * Add podspec to support releases via cocoapods
  * Add support for HID over I2C and uhid devices (#166)
  * Fix small casting issue
  * Fix race condition on device close (#189)
  * Fix API prototype for gcc flag -Wstrict-prototypes (#207)
  * Fix strict typecast (#206)
  * Fix -Wall -Wextra -pedantic -Werror compilation (#214) ￼…
  * Drop workaround for kernel &lt; 2.6.34
  * Use pkg-config to find libusb on *freebsd
  * Reattach kernel driver in hidapi-libusb
  * Move local variable declaration to the beginning of the function</changelog>
</package>
<package pkgid="bab3e7c02fc1a4cab2318484c7845e69cdb21ab1fa3bacadcd0a0bbc3f0a2e2f" name="kernel-default" arch="aarch64">
  <version epoch="0" ver="5.14.21" rel="150500.55.28.1"/>
  <changelog author="nmorey@suse.com" date="1693828800">- RDMA/siw: Correct wrong debug message (git-fixes)
- commit 3732fc1</changelog>
  <changelog author="nmorey@suse.com" date="1693828801">- RDMA/efa: Fix wrong resources deallocation order (git-fixes)
- commit c7f667b</changelog>
  <changelog author="nmorey@suse.com" date="1693828802">- scsi: RDMA/srp: Fix residual handling (git-fixes)
- commit 429e77b</changelog>
  <changelog author="mfranc@suse.cz" date="1693828803">- Refresh
  patches.suse/0002-nvme-tcp-fix-potential-unbalanced-freeze-unfreeze.patch.
- Refresh
  patches.suse/0003-nvme-rdma-fix-potential-unbalanced-freeze-unfreeze.patch.
- commit 452e63f</changelog>
  <changelog author="oneukum@suse.com" date="1693828804">- USB: core: Unite old scheme and new scheme descriptor reads
  (bsc#1213123 CVE-2023-37453).
- commit 9f60ef1</changelog>
  <changelog author="oneukum@suse.com" date="1693828805">- USB: core: Fix race by not overwriting udev-&gt;descriptor in
  hub_port_init() (bsc#1213123 CVE-2023-37453).
- commit a1f446d</changelog>
  <changelog author="mgorman@suse.de" date="1693828806">- blacklist.conf: Not a fix, relatively high risk of performance regression
- commit fd04425</changelog>
  <changelog author="oneukum@suse.com" date="1693828807">- USB: core: Fix oversight in SuperSpeed initialization
  (bsc#1213123 CVE-2023-37453).
- commit 6b6c148</changelog>
  <changelog author="mgorman@suse.de" date="1693828808">- sched/fair: Use recent_used_cpu to test p-&gt;cpus_ptr (git fixes).
- sched/fair: Fix inaccurate tally of ttwu_move_affine (git
  fixes).
- commit 4be7d48</changelog>
  <changelog author="tiwai@suse.de" date="1693915200">- cpufreq: Fix the race condition while updating the
  transition_task of policy (git-fixes).
- rpmsg: glink: Add check for kstrdup (git-fixes).
- leds: turris-omnia: Drop unnecessary mutex locking (git-fixes).
- leds: trigger: tty: Do not use LED_ON/OFF constants, use
  led_blink_set_oneshot instead (git-fixes).
- leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always
  false (git-fixes).
- leds: multicolor: Use rounded division when calculating color
  components (git-fixes).
- leds: pwm: Fix error code in led_pwm_create_fwnode()
  (git-fixes).
- docs: printk-formats: Fix hex printing of signed values
  (git-fixes).
- commit 1c98d58</changelog>
  <changelog author="mfranc@suse.cz" date="1693915201">- s390/ipl: add missing secure/has_secure file to ipl type
  'unknown' (bsc#1214976).
- commit 33974e8</changelog>
  <changelog author="tzimmermann@suse.com" date="1693915202">- "drm/vmwgfx: Remove rcu locks from user resources" (bsc#1203329 CVE-2022-40133 bsc#1203330 CVE-2022-38457)
  This patch also fixes two CVEs. Update the References tag accordingly.
- commit 552e790</changelog>
  <changelog author="nik.borisov@suse.com" date="1693915203">- x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (git-fixes).
- commit 47ff352</changelog>
  <changelog author="mkubecek@suse.cz" date="1693915204">- netfilter: nf_tables: use correct lock to protect gc_list
  (CVE-2023-4563 bsc#1214727).
- netfilter: nf_tables: GC transaction race with abort path
  (CVE-2023-4563 bsc#1214727).
- netfilter: nf_tables: GC transaction race with netns dismantle
  (CVE-2023-4563 bsc#1214727).
- netfilter: nf_tables: fix GC transaction races with netns and
  netlink event exit path (CVE-2023-4563 bsc#1214727).
- netfilter: nf_tables: fix kdoc warnings after gc rework
  (CVE-2023-4563 bsc#1214727).
- refresh
  - patches.kabi/kabi-hide-changes-in-struct-nft_set.patch
- kabi: hide changes in struct nft_set (CVE-2023-4563
  bsc#1214727).
- netfilter: nf_tables: GC transaction API to avoid race with
  control plane (CVE-2023-4563 bsc#1214727).
- commit cfed41c</changelog>
  <changelog author="msuchanek@suse.de" date="1693915205">- Refresh sorted section
- commit a6fbcee</changelog>
  <changelog author="msuchanek@suse.de" date="1693915206">- powerpc/rtas: mandate RTAS syscall filtering (bsc#1023051).
- commit ac82be8</changelog>
  <changelog author="jlee@suse.com" date="1694001600">- Update References
  patches.suse/Bluetooth-L2CAP-Fix-use-after-free-in-l2cap_sock_rea.patch
  (git-fixes bsc#1214233 CVE-2023-40283).
- commit 63a801c</changelog>
  <changelog author="jkosina@suse.cz" date="1695297600">- USB: core: Change usb_get_device_descriptor() API (bsc#1213123
  CVE-2023-37453 bsc#1215553 bsc#1215522 bsc#1215552).
  Refresh patches.suse/USB-core-Fix-race-by-not-overwriting-udev-descriptor.patch (add missing hunk)
  Refresh patches.suse/USB-core-Fix-oversight-in-SuperSpeed-initialization.patch (context)
- commit be6100d</changelog>
  <changelog author="osalvador@suse.de" date="1695297601">- Drop amdgpu patch causing spamming (bsc#1215523)
  Deleted:
  patches.suse/drm-amdgpu-install-stub-fence-into-potential-unused-.patch.
- commit 2351f50</changelog>
  <changelog author="osalvador@suse.de" date="1695384000">- x86/sev: Make enc_dec_hypercall() accept a size instead of
  npages (bsc#1214635).
- commit c11336f</changelog>
</package>
<package pkgid="b2339af15aaaaf7c8dab29ca25b7072542bf58ea4e5578f046c0b63c521bdc27" name="kernel-default" arch="src">
  <version epoch="0" ver="5.14.21" rel="150500.55.28.1"/>
  <changelog author="nmorey@suse.com" date="1693828800">- RDMA/siw: Correct wrong debug message (git-fixes)
- commit 3732fc1</changelog>
  <changelog author="nmorey@suse.com" date="1693828801">- RDMA/efa: Fix wrong resources deallocation order (git-fixes)
- commit c7f667b</changelog>
  <changelog author="nmorey@suse.com" date="1693828802">- scsi: RDMA/srp: Fix residual handling (git-fixes)
- commit 429e77b</changelog>
  <changelog author="mfranc@suse.cz" date="1693828803">- Refresh
  patches.suse/0002-nvme-tcp-fix-potential-unbalanced-freeze-unfreeze.patch.
- Refresh
  patches.suse/0003-nvme-rdma-fix-potential-unbalanced-freeze-unfreeze.patch.
- commit 452e63f</changelog>
  <changelog author="oneukum@suse.com" date="1693828804">- USB: core: Unite old scheme and new scheme descriptor reads
  (bsc#1213123 CVE-2023-37453).
- commit 9f60ef1</changelog>
  <changelog author="oneukum@suse.com" date="1693828805">- USB: core: Fix race by not overwriting udev-&gt;descriptor in
  hub_port_init() (bsc#1213123 CVE-2023-37453).
- commit a1f446d</changelog>
  <changelog author="mgorman@suse.de" date="1693828806">- blacklist.conf: Not a fix, relatively high risk of performance regression
- commit fd04425</changelog>
  <changelog author="oneukum@suse.com" date="1693828807">- USB: core: Fix oversight in SuperSpeed initialization
  (bsc#1213123 CVE-2023-37453).
- commit 6b6c148</changelog>
  <changelog author="mgorman@suse.de" date="1693828808">- sched/fair: Use recent_used_cpu to test p-&gt;cpus_ptr (git fixes).
- sched/fair: Fix inaccurate tally of ttwu_move_affine (git
  fixes).
- commit 4be7d48</changelog>
  <changelog author="tiwai@suse.de" date="1693915200">- cpufreq: Fix the race condition while updating the
  transition_task of policy (git-fixes).
- rpmsg: glink: Add check for kstrdup (git-fixes).
- leds: turris-omnia: Drop unnecessary mutex locking (git-fixes).
- leds: trigger: tty: Do not use LED_ON/OFF constants, use
  led_blink_set_oneshot instead (git-fixes).
- leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always
  false (git-fixes).
- leds: multicolor: Use rounded division when calculating color
  components (git-fixes).
- leds: pwm: Fix error code in led_pwm_create_fwnode()
  (git-fixes).
- docs: printk-formats: Fix hex printing of signed values
  (git-fixes).
- commit 1c98d58</changelog>
  <changelog author="mfranc@suse.cz" date="1693915201">- s390/ipl: add missing secure/has_secure file to ipl type
  'unknown' (bsc#1214976).
- commit 33974e8</changelog>
  <changelog author="tzimmermann@suse.com" date="1693915202">- "drm/vmwgfx: Remove rcu locks from user resources" (bsc#1203329 CVE-2022-40133 bsc#1203330 CVE-2022-38457)
  This patch also fixes two CVEs. Update the References tag accordingly.
- commit 552e790</changelog>
  <changelog author="nik.borisov@suse.com" date="1693915203">- x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (git-fixes).
- commit 47ff352</changelog>
  <changelog author="mkubecek@suse.cz" date="1693915204">- netfilter: nf_tables: use correct lock to protect gc_list
  (CVE-2023-4563 bsc#1214727).
- netfilter: nf_tables: GC transaction race with abort path
  (CVE-2023-4563 bsc#1214727).
- netfilter: nf_tables: GC transaction race with netns dismantle
  (CVE-2023-4563 bsc#1214727).
- netfilter: nf_tables: fix GC transaction races with netns and
  netlink event exit path (CVE-2023-4563 bsc#1214727).
- netfilter: nf_tables: fix kdoc warnings after gc rework
  (CVE-2023-4563 bsc#1214727).
- refresh
  - patches.kabi/kabi-hide-changes-in-struct-nft_set.patch
- kabi: hide changes in struct nft_set (CVE-2023-4563
  bsc#1214727).
- netfilter: nf_tables: GC transaction API to avoid race with
  control plane (CVE-2023-4563 bsc#1214727).
- commit cfed41c</changelog>
  <changelog author="msuchanek@suse.de" date="1693915205">- Refresh sorted section
- commit a6fbcee</changelog>
  <changelog author="msuchanek@suse.de" date="1693915206">- powerpc/rtas: mandate RTAS syscall filtering (bsc#1023051).
- commit ac82be8</changelog>
  <changelog author="jlee@suse.com" date="1694001600">- Update References
  patches.suse/Bluetooth-L2CAP-Fix-use-after-free-in-l2cap_sock_rea.patch
  (git-fixes bsc#1214233 CVE-2023-40283).
- commit 63a801c</changelog>
  <changelog author="jkosina@suse.cz" date="1695297600">- USB: core: Change usb_get_device_descriptor() API (bsc#1213123
  CVE-2023-37453 bsc#1215553 bsc#1215522 bsc#1215552).
  Refresh patches.suse/USB-core-Fix-race-by-not-overwriting-udev-descriptor.patch (add missing hunk)
  Refresh patches.suse/USB-core-Fix-oversight-in-SuperSpeed-initialization.patch (context)
- commit be6100d</changelog>
  <changelog author="osalvador@suse.de" date="1695297601">- Drop amdgpu patch causing spamming (bsc#1215523)
  Deleted:
  patches.suse/drm-amdgpu-install-stub-fence-into-potential-unused-.patch.
- commit 2351f50</changelog>
  <changelog author="osalvador@suse.de" date="1695384000">- x86/sev: Make enc_dec_hypercall() accept a size instead of
  npages (bsc#1214635).
- commit c11336f</changelog>
</package>
<package pkgid="78ac205ab03cecedfe7e1e3553c801dce1c91037ca403a48f4d7051c56eee00a" name="kernel-default" arch="s390x">
  <version epoch="0" ver="5.14.21" rel="150500.55.28.1"/>
  <changelog author="nmorey@suse.com" date="1693828800">- RDMA/siw: Correct wrong debug message (git-fixes)
- commit 3732fc1</changelog>
  <changelog author="nmorey@suse.com" date="1693828801">- RDMA/efa: Fix wrong resources deallocation order (git-fixes)
- commit c7f667b</changelog>
  <changelog author="nmorey@suse.com" date="1693828802">- scsi: RDMA/srp: Fix residual handling (git-fixes)
- commit 429e77b</changelog>
  <changelog author="mfranc@suse.cz" date="1693828803">- Refresh
  patches.suse/0002-nvme-tcp-fix-potential-unbalanced-freeze-unfreeze.patch.
- Refresh
  patches.suse/0003-nvme-rdma-fix-potential-unbalanced-freeze-unfreeze.patch.
- commit 452e63f</changelog>
  <changelog author="oneukum@suse.com" date="1693828804">- USB: core: Unite old scheme and new scheme descriptor reads
  (bsc#1213123 CVE-2023-37453).
- commit 9f60ef1</changelog>
  <changelog author="oneukum@suse.com" date="1693828805">- USB: core: Fix race by not overwriting udev-&gt;descriptor in
  hub_port_init() (bsc#1213123 CVE-2023-37453).
- commit a1f446d</changelog>
  <changelog author="mgorman@suse.de" date="1693828806">- blacklist.conf: Not a fix, relatively high risk of performance regression
- commit fd04425</changelog>
  <changelog author="oneukum@suse.com" date="1693828807">- USB: core: Fix oversight in SuperSpeed initialization
  (bsc#1213123 CVE-2023-37453).
- commit 6b6c148</changelog>
  <changelog author="mgorman@suse.de" date="1693828808">- sched/fair: Use recent_used_cpu to test p-&gt;cpus_ptr (git fixes).
- sched/fair: Fix inaccurate tally of ttwu_move_affine (git
  fixes).
- commit 4be7d48</changelog>
  <changelog author="tiwai@suse.de" date="1693915200">- cpufreq: Fix the race condition while updating the
  transition_task of policy (git-fixes).
- rpmsg: glink: Add check for kstrdup (git-fixes).
- leds: turris-omnia: Drop unnecessary mutex locking (git-fixes).
- leds: trigger: tty: Do not use LED_ON/OFF constants, use
  led_blink_set_oneshot instead (git-fixes).
- leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always
  false (git-fixes).
- leds: multicolor: Use rounded division when calculating color
  components (git-fixes).
- leds: pwm: Fix error code in led_pwm_create_fwnode()
  (git-fixes).
- docs: printk-formats: Fix hex printing of signed values
  (git-fixes).
- commit 1c98d58</changelog>
  <changelog author="mfranc@suse.cz" date="1693915201">- s390/ipl: add missing secure/has_secure file to ipl type
  'unknown' (bsc#1214976).
- commit 33974e8</changelog>
  <changelog author="tzimmermann@suse.com" date="1693915202">- "drm/vmwgfx: Remove rcu locks from user resources" (bsc#1203329 CVE-2022-40133 bsc#1203330 CVE-2022-38457)
  This patch also fixes two CVEs. Update the References tag accordingly.
- commit 552e790</changelog>
  <changelog author="nik.borisov@suse.com" date="1693915203">- x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (git-fixes).
- commit 47ff352</changelog>
  <changelog author="mkubecek@suse.cz" date="1693915204">- netfilter: nf_tables: use correct lock to protect gc_list
  (CVE-2023-4563 bsc#1214727).
- netfilter: nf_tables: GC transaction race with abort path
  (CVE-2023-4563 bsc#1214727).
- netfilter: nf_tables: GC transaction race with netns dismantle
  (CVE-2023-4563 bsc#1214727).
- netfilter: nf_tables: fix GC transaction races with netns and
  netlink event exit path (CVE-2023-4563 bsc#1214727).
- netfilter: nf_tables: fix kdoc warnings after gc rework
  (CVE-2023-4563 bsc#1214727).
- refresh
  - patches.kabi/kabi-hide-changes-in-struct-nft_set.patch
- kabi: hide changes in struct nft_set (CVE-2023-4563
  bsc#1214727).
- netfilter: nf_tables: GC transaction API to avoid race with
  control plane (CVE-2023-4563 bsc#1214727).
- commit cfed41c</changelog>
  <changelog author="msuchanek@suse.de" date="1693915205">- Refresh sorted section
- commit a6fbcee</changelog>
  <changelog author="msuchanek@suse.de" date="1693915206">- powerpc/rtas: mandate RTAS syscall filtering (bsc#1023051).
- commit ac82be8</changelog>
  <changelog author="jlee@suse.com" date="1694001600">- Update References
  patches.suse/Bluetooth-L2CAP-Fix-use-after-free-in-l2cap_sock_rea.patch
  (git-fixes bsc#1214233 CVE-2023-40283).
- commit 63a801c</changelog>
  <changelog author="jkosina@suse.cz" date="1695297600">- USB: core: Change usb_get_device_descriptor() API (bsc#1213123
  CVE-2023-37453 bsc#1215553 bsc#1215522 bsc#1215552).
  Refresh patches.suse/USB-core-Fix-race-by-not-overwriting-udev-descriptor.patch (add missing hunk)
  Refresh patches.suse/USB-core-Fix-oversight-in-SuperSpeed-initialization.patch (context)
- commit be6100d</changelog>
  <changelog author="osalvador@suse.de" date="1695297601">- Drop amdgpu patch causing spamming (bsc#1215523)
  Deleted:
  patches.suse/drm-amdgpu-install-stub-fence-into-potential-unused-.patch.
- commit 2351f50</changelog>
  <changelog author="osalvador@suse.de" date="1695384000">- x86/sev: Make enc_dec_hypercall() accept a size instead of
  npages (bsc#1214635).
- commit c11336f</changelog>
</package>
<package pkgid="3f709658cfdb74bc4827353ef975373b7617aed058d0c14f1bc5b8c88994220f" name="kernel-default" arch="x86_64">
  <version epoch="0" ver="5.14.21" rel="150500.55.28.1"/>
  <changelog author="nmorey@suse.com" date="1693828800">- RDMA/siw: Correct wrong debug message (git-fixes)
- commit 3732fc1</changelog>
  <changelog author="nmorey@suse.com" date="1693828801">- RDMA/efa: Fix wrong resources deallocation order (git-fixes)
- commit c7f667b</changelog>
  <changelog author="nmorey@suse.com" date="1693828802">- scsi: RDMA/srp: Fix residual handling (git-fixes)
- commit 429e77b</changelog>
  <changelog author="mfranc@suse.cz" date="1693828803">- Refresh
  patches.suse/0002-nvme-tcp-fix-potential-unbalanced-freeze-unfreeze.patch.
- Refresh
  patches.suse/0003-nvme-rdma-fix-potential-unbalanced-freeze-unfreeze.patch.
- commit 452e63f</changelog>
  <changelog author="oneukum@suse.com" date="1693828804">- USB: core: Unite old scheme and new scheme descriptor reads
  (bsc#1213123 CVE-2023-37453).
- commit 9f60ef1</changelog>
  <changelog author="oneukum@suse.com" date="1693828805">- USB: core: Fix race by not overwriting udev-&gt;descriptor in
  hub_port_init() (bsc#1213123 CVE-2023-37453).
- commit a1f446d</changelog>
  <changelog author="mgorman@suse.de" date="1693828806">- blacklist.conf: Not a fix, relatively high risk of performance regression
- commit fd04425</changelog>
  <changelog author="oneukum@suse.com" date="1693828807">- USB: core: Fix oversight in SuperSpeed initialization
  (bsc#1213123 CVE-2023-37453).
- commit 6b6c148</changelog>
  <changelog author="mgorman@suse.de" date="1693828808">- sched/fair: Use recent_used_cpu to test p-&gt;cpus_ptr (git fixes).
- sched/fair: Fix inaccurate tally of ttwu_move_affine (git
  fixes).
- commit 4be7d48</changelog>
  <changelog author="tiwai@suse.de" date="1693915200">- cpufreq: Fix the race condition while updating the
  transition_task of policy (git-fixes).
- rpmsg: glink: Add check for kstrdup (git-fixes).
- leds: turris-omnia: Drop unnecessary mutex locking (git-fixes).
- leds: trigger: tty: Do not use LED_ON/OFF constants, use
  led_blink_set_oneshot instead (git-fixes).
- leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always
  false (git-fixes).
- leds: multicolor: Use rounded division when calculating color
  components (git-fixes).
- leds: pwm: Fix error code in led_pwm_create_fwnode()
  (git-fixes).
- docs: printk-formats: Fix hex printing of signed values
  (git-fixes).
- commit 1c98d58</changelog>
  <changelog author="mfranc@suse.cz" date="1693915201">- s390/ipl: add missing secure/has_secure file to ipl type
  'unknown' (bsc#1214976).
- commit 33974e8</changelog>
  <changelog author="tzimmermann@suse.com" date="1693915202">- "drm/vmwgfx: Remove rcu locks from user resources" (bsc#1203329 CVE-2022-40133 bsc#1203330 CVE-2022-38457)
  This patch also fixes two CVEs. Update the References tag accordingly.
- commit 552e790</changelog>
  <changelog author="nik.borisov@suse.com" date="1693915203">- x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (git-fixes).
- commit 47ff352</changelog>
  <changelog author="mkubecek@suse.cz" date="1693915204">- netfilter: nf_tables: use correct lock to protect gc_list
  (CVE-2023-4563 bsc#1214727).
- netfilter: nf_tables: GC transaction race with abort path
  (CVE-2023-4563 bsc#1214727).
- netfilter: nf_tables: GC transaction race with netns dismantle
  (CVE-2023-4563 bsc#1214727).
- netfilter: nf_tables: fix GC transaction races with netns and
  netlink event exit path (CVE-2023-4563 bsc#1214727).
- netfilter: nf_tables: fix kdoc warnings after gc rework
  (CVE-2023-4563 bsc#1214727).
- refresh
  - patches.kabi/kabi-hide-changes-in-struct-nft_set.patch
- kabi: hide changes in struct nft_set (CVE-2023-4563
  bsc#1214727).
- netfilter: nf_tables: GC transaction API to avoid race with
  control plane (CVE-2023-4563 bsc#1214727).
- commit cfed41c</changelog>
  <changelog author="msuchanek@suse.de" date="1693915205">- Refresh sorted section
- commit a6fbcee</changelog>
  <changelog author="msuchanek@suse.de" date="1693915206">- powerpc/rtas: mandate RTAS syscall filtering (bsc#1023051).
- commit ac82be8</changelog>
  <changelog author="jlee@suse.com" date="1694001600">- Update References
  patches.suse/Bluetooth-L2CAP-Fix-use-after-free-in-l2cap_sock_rea.patch
  (git-fixes bsc#1214233 CVE-2023-40283).
- commit 63a801c</changelog>
  <changelog author="jkosina@suse.cz" date="1695297600">- USB: core: Change usb_get_device_descriptor() API (bsc#1213123
  CVE-2023-37453 bsc#1215553 bsc#1215522 bsc#1215552).
  Refresh patches.suse/USB-core-Fix-race-by-not-overwriting-udev-descriptor.patch (add missing hunk)
  Refresh patches.suse/USB-core-Fix-oversight-in-SuperSpeed-initialization.patch (context)
- commit be6100d</changelog>
  <changelog author="osalvador@suse.de" date="1695297601">- Drop amdgpu patch causing spamming (bsc#1215523)
  Deleted:
  patches.suse/drm-amdgpu-install-stub-fence-into-potential-unused-.patch.
- commit 2351f50</changelog>
  <changelog author="osalvador@suse.de" date="1695384000">- x86/sev: Make enc_dec_hypercall() accept a size instead of
  npages (bsc#1214635).
- commit c11336f</changelog>
</package>
<package pkgid="47ac15b2c93efbf33364034ea112f4244948c36e25bfc38e6945a3901a906d5c" name="kernel-default" arch="aarch64">
  <version epoch="0" ver="5.14.21" rel="150500.55.31.1"/>
  <changelog author="pmladek@suse.com" date="1696248000">- printk: ringbuffer: Fix truncating buffer size min_t cast
  (bsc#1215875).
- commit e0d3999</changelog>
  <changelog author="pmladek@suse.com" date="1696248001">- blacklist.conf: printk: the changes look good but they do not fix
  any serious problem
- commit c560ceb</changelog>
  <changelog author="pmladek@suse.com" date="1696248002">- blacklist.conf: workqueue: Code refactoring
- commit e204334</changelog>
  <changelog author="pmladek@suse.com" date="1696248003">- blacklist.conf: workqueue: compiler warning on 32-bit systems with
  Clang (bsc#1215877)
- commit b7e65aa</changelog>
  <changelog author="mkubecek@suse.cz" date="1696334400">- tcp: Reduce chance of collisions in inet6_hashfn()
  (CVE-2023-1206 bsc#1212703).
- commit e3ebd17</changelog>
  <changelog author="mkubecek@suse.cz" date="1696334401">- netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro
  for ip_set_hash_netportnet.c (CVE-2023-42753 bsc#1215150).
- commit 7a6be79</changelog>
  <changelog author="mfranc@suse.cz" date="1696334402">- KVM: s390: vsie: Fix the initialization of the epoch extension
  (epdx) field (git-fixes bsc#1215894).
- commit 9c5bbd7</changelog>
  <changelog author="mfranc@suse.cz" date="1696334403">- KVM: s390: vsie: fix the length of APCB bitmap (git-fixes
  bsc#1215895).
- commit 9ff1a1e</changelog>
  <changelog author="mfranc@suse.cz" date="1696334404">- KVM: s390: interrupt: use READ_ONCE() before cmpxchg()
  (git-fixes bsc#1215896).
- commit 8726736</changelog>
  <changelog author="mfranc@suse.cz" date="1696334405">- blacklist.conf: kABi breakage (vmalloc)
- commit 10bad47</changelog>
  <changelog author="palcantara@suse.de" date="1696334406">- fs/smb/client: Reset password pointer to NULL (bsc#1215899
  CVE-2023-5345).
- commit 679511d</changelog>
  <changelog author="mfranc@suse.cz" date="1696334407">- KVM: s390/diag: fix racy access of physical cpu number in diag
  9c handler (git-fixes bsc#1215911).
- commit 6454286</changelog>
  <changelog author="mfranc@suse.cz" date="1696334408">- KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
  (git-fixes bsc#1215915).
- commit fe7fbfc</changelog>
  <changelog author="jdelvare@suse.de" date="1696334409">- btrfs: fix root ref counts in error handling in
  btrfs_get_root_ref (bsc#1214351 CVE-2023-4389).
- commit 3731029</changelog>
  <changelog author="mfranc@suse.cz" date="1696334410">- KVM: s390: pv: fix external interruption loop not always
  detected (git-fixes bsc#1215916).
- commit f1893aa</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420800">- ipv4: fix null-deref in ipv4_link_failure (CVE-2023-42754
  bsc#1215467).
- commit ad87dd3</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420801">- netfilter: xt_u32: validate user space input (CVE-2023-39192
  bsc#1215858).
- commit 292c059</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420802">- netfilter: xt_sctp: validate the flag_info count (CVE-2023-39193
  bsc#1215860).
- commit 5ec24b7</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420803">- net: xfrm: Fix xfrm_address_filter OOB read (CVE-2023-39194
  bsc#1215861).
- commit 55308cb</changelog>
  <changelog author="mfranc@suse.cz" date="1696420804">- scsi: zfcp: Fix a double put in zfcp_port_enqueue() (git-fixes
  bsc#1215941).
- commit a62865f</changelog>
</package>
<package pkgid="ebdc69c212da995a28f9254bb0b60191d7aa475dd80791fbbdecbb46a419e764" name="kernel-default" arch="src">
  <version epoch="0" ver="5.14.21" rel="150500.55.31.1"/>
  <changelog author="pmladek@suse.com" date="1696248000">- printk: ringbuffer: Fix truncating buffer size min_t cast
  (bsc#1215875).
- commit e0d3999</changelog>
  <changelog author="pmladek@suse.com" date="1696248001">- blacklist.conf: printk: the changes look good but they do not fix
  any serious problem
- commit c560ceb</changelog>
  <changelog author="pmladek@suse.com" date="1696248002">- blacklist.conf: workqueue: Code refactoring
- commit e204334</changelog>
  <changelog author="pmladek@suse.com" date="1696248003">- blacklist.conf: workqueue: compiler warning on 32-bit systems with
  Clang (bsc#1215877)
- commit b7e65aa</changelog>
  <changelog author="mkubecek@suse.cz" date="1696334400">- tcp: Reduce chance of collisions in inet6_hashfn()
  (CVE-2023-1206 bsc#1212703).
- commit e3ebd17</changelog>
  <changelog author="mkubecek@suse.cz" date="1696334401">- netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro
  for ip_set_hash_netportnet.c (CVE-2023-42753 bsc#1215150).
- commit 7a6be79</changelog>
  <changelog author="mfranc@suse.cz" date="1696334402">- KVM: s390: vsie: Fix the initialization of the epoch extension
  (epdx) field (git-fixes bsc#1215894).
- commit 9c5bbd7</changelog>
  <changelog author="mfranc@suse.cz" date="1696334403">- KVM: s390: vsie: fix the length of APCB bitmap (git-fixes
  bsc#1215895).
- commit 9ff1a1e</changelog>
  <changelog author="mfranc@suse.cz" date="1696334404">- KVM: s390: interrupt: use READ_ONCE() before cmpxchg()
  (git-fixes bsc#1215896).
- commit 8726736</changelog>
  <changelog author="mfranc@suse.cz" date="1696334405">- blacklist.conf: kABi breakage (vmalloc)
- commit 10bad47</changelog>
  <changelog author="palcantara@suse.de" date="1696334406">- fs/smb/client: Reset password pointer to NULL (bsc#1215899
  CVE-2023-5345).
- commit 679511d</changelog>
  <changelog author="mfranc@suse.cz" date="1696334407">- KVM: s390/diag: fix racy access of physical cpu number in diag
  9c handler (git-fixes bsc#1215911).
- commit 6454286</changelog>
  <changelog author="mfranc@suse.cz" date="1696334408">- KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
  (git-fixes bsc#1215915).
- commit fe7fbfc</changelog>
  <changelog author="jdelvare@suse.de" date="1696334409">- btrfs: fix root ref counts in error handling in
  btrfs_get_root_ref (bsc#1214351 CVE-2023-4389).
- commit 3731029</changelog>
  <changelog author="mfranc@suse.cz" date="1696334410">- KVM: s390: pv: fix external interruption loop not always
  detected (git-fixes bsc#1215916).
- commit f1893aa</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420800">- ipv4: fix null-deref in ipv4_link_failure (CVE-2023-42754
  bsc#1215467).
- commit ad87dd3</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420801">- netfilter: xt_u32: validate user space input (CVE-2023-39192
  bsc#1215858).
- commit 292c059</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420802">- netfilter: xt_sctp: validate the flag_info count (CVE-2023-39193
  bsc#1215860).
- commit 5ec24b7</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420803">- net: xfrm: Fix xfrm_address_filter OOB read (CVE-2023-39194
  bsc#1215861).
- commit 55308cb</changelog>
  <changelog author="mfranc@suse.cz" date="1696420804">- scsi: zfcp: Fix a double put in zfcp_port_enqueue() (git-fixes
  bsc#1215941).
- commit a62865f</changelog>
</package>
<package pkgid="9d4acec134768b920ea41e5f397e8c235c68d7bb64188463cb040b9f9ff464e7" name="kernel-default" arch="s390x">
  <version epoch="0" ver="5.14.21" rel="150500.55.31.1"/>
  <changelog author="pmladek@suse.com" date="1696248000">- printk: ringbuffer: Fix truncating buffer size min_t cast
  (bsc#1215875).
- commit e0d3999</changelog>
  <changelog author="pmladek@suse.com" date="1696248001">- blacklist.conf: printk: the changes look good but they do not fix
  any serious problem
- commit c560ceb</changelog>
  <changelog author="pmladek@suse.com" date="1696248002">- blacklist.conf: workqueue: Code refactoring
- commit e204334</changelog>
  <changelog author="pmladek@suse.com" date="1696248003">- blacklist.conf: workqueue: compiler warning on 32-bit systems with
  Clang (bsc#1215877)
- commit b7e65aa</changelog>
  <changelog author="mkubecek@suse.cz" date="1696334400">- tcp: Reduce chance of collisions in inet6_hashfn()
  (CVE-2023-1206 bsc#1212703).
- commit e3ebd17</changelog>
  <changelog author="mkubecek@suse.cz" date="1696334401">- netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro
  for ip_set_hash_netportnet.c (CVE-2023-42753 bsc#1215150).
- commit 7a6be79</changelog>
  <changelog author="mfranc@suse.cz" date="1696334402">- KVM: s390: vsie: Fix the initialization of the epoch extension
  (epdx) field (git-fixes bsc#1215894).
- commit 9c5bbd7</changelog>
  <changelog author="mfranc@suse.cz" date="1696334403">- KVM: s390: vsie: fix the length of APCB bitmap (git-fixes
  bsc#1215895).
- commit 9ff1a1e</changelog>
  <changelog author="mfranc@suse.cz" date="1696334404">- KVM: s390: interrupt: use READ_ONCE() before cmpxchg()
  (git-fixes bsc#1215896).
- commit 8726736</changelog>
  <changelog author="mfranc@suse.cz" date="1696334405">- blacklist.conf: kABi breakage (vmalloc)
- commit 10bad47</changelog>
  <changelog author="palcantara@suse.de" date="1696334406">- fs/smb/client: Reset password pointer to NULL (bsc#1215899
  CVE-2023-5345).
- commit 679511d</changelog>
  <changelog author="mfranc@suse.cz" date="1696334407">- KVM: s390/diag: fix racy access of physical cpu number in diag
  9c handler (git-fixes bsc#1215911).
- commit 6454286</changelog>
  <changelog author="mfranc@suse.cz" date="1696334408">- KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
  (git-fixes bsc#1215915).
- commit fe7fbfc</changelog>
  <changelog author="jdelvare@suse.de" date="1696334409">- btrfs: fix root ref counts in error handling in
  btrfs_get_root_ref (bsc#1214351 CVE-2023-4389).
- commit 3731029</changelog>
  <changelog author="mfranc@suse.cz" date="1696334410">- KVM: s390: pv: fix external interruption loop not always
  detected (git-fixes bsc#1215916).
- commit f1893aa</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420800">- ipv4: fix null-deref in ipv4_link_failure (CVE-2023-42754
  bsc#1215467).
- commit ad87dd3</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420801">- netfilter: xt_u32: validate user space input (CVE-2023-39192
  bsc#1215858).
- commit 292c059</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420802">- netfilter: xt_sctp: validate the flag_info count (CVE-2023-39193
  bsc#1215860).
- commit 5ec24b7</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420803">- net: xfrm: Fix xfrm_address_filter OOB read (CVE-2023-39194
  bsc#1215861).
- commit 55308cb</changelog>
  <changelog author="mfranc@suse.cz" date="1696420804">- scsi: zfcp: Fix a double put in zfcp_port_enqueue() (git-fixes
  bsc#1215941).
- commit a62865f</changelog>
</package>
<package pkgid="ba5dd593e52ae94846d9ee8aa9051f1f69a42c7a653df83226969e01c5c8ba60" name="kernel-default" arch="x86_64">
  <version epoch="0" ver="5.14.21" rel="150500.55.31.1"/>
  <changelog author="pmladek@suse.com" date="1696248000">- printk: ringbuffer: Fix truncating buffer size min_t cast
  (bsc#1215875).
- commit e0d3999</changelog>
  <changelog author="pmladek@suse.com" date="1696248001">- blacklist.conf: printk: the changes look good but they do not fix
  any serious problem
- commit c560ceb</changelog>
  <changelog author="pmladek@suse.com" date="1696248002">- blacklist.conf: workqueue: Code refactoring
- commit e204334</changelog>
  <changelog author="pmladek@suse.com" date="1696248003">- blacklist.conf: workqueue: compiler warning on 32-bit systems with
  Clang (bsc#1215877)
- commit b7e65aa</changelog>
  <changelog author="mkubecek@suse.cz" date="1696334400">- tcp: Reduce chance of collisions in inet6_hashfn()
  (CVE-2023-1206 bsc#1212703).
- commit e3ebd17</changelog>
  <changelog author="mkubecek@suse.cz" date="1696334401">- netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro
  for ip_set_hash_netportnet.c (CVE-2023-42753 bsc#1215150).
- commit 7a6be79</changelog>
  <changelog author="mfranc@suse.cz" date="1696334402">- KVM: s390: vsie: Fix the initialization of the epoch extension
  (epdx) field (git-fixes bsc#1215894).
- commit 9c5bbd7</changelog>
  <changelog author="mfranc@suse.cz" date="1696334403">- KVM: s390: vsie: fix the length of APCB bitmap (git-fixes
  bsc#1215895).
- commit 9ff1a1e</changelog>
  <changelog author="mfranc@suse.cz" date="1696334404">- KVM: s390: interrupt: use READ_ONCE() before cmpxchg()
  (git-fixes bsc#1215896).
- commit 8726736</changelog>
  <changelog author="mfranc@suse.cz" date="1696334405">- blacklist.conf: kABi breakage (vmalloc)
- commit 10bad47</changelog>
  <changelog author="palcantara@suse.de" date="1696334406">- fs/smb/client: Reset password pointer to NULL (bsc#1215899
  CVE-2023-5345).
- commit 679511d</changelog>
  <changelog author="mfranc@suse.cz" date="1696334407">- KVM: s390/diag: fix racy access of physical cpu number in diag
  9c handler (git-fixes bsc#1215911).
- commit 6454286</changelog>
  <changelog author="mfranc@suse.cz" date="1696334408">- KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
  (git-fixes bsc#1215915).
- commit fe7fbfc</changelog>
  <changelog author="jdelvare@suse.de" date="1696334409">- btrfs: fix root ref counts in error handling in
  btrfs_get_root_ref (bsc#1214351 CVE-2023-4389).
- commit 3731029</changelog>
  <changelog author="mfranc@suse.cz" date="1696334410">- KVM: s390: pv: fix external interruption loop not always
  detected (git-fixes bsc#1215916).
- commit f1893aa</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420800">- ipv4: fix null-deref in ipv4_link_failure (CVE-2023-42754
  bsc#1215467).
- commit ad87dd3</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420801">- netfilter: xt_u32: validate user space input (CVE-2023-39192
  bsc#1215858).
- commit 292c059</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420802">- netfilter: xt_sctp: validate the flag_info count (CVE-2023-39193
  bsc#1215860).
- commit 5ec24b7</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420803">- net: xfrm: Fix xfrm_address_filter OOB read (CVE-2023-39194
  bsc#1215861).
- commit 55308cb</changelog>
  <changelog author="mfranc@suse.cz" date="1696420804">- scsi: zfcp: Fix a double put in zfcp_port_enqueue() (git-fixes
  bsc#1215941).
- commit a62865f</changelog>
</package>
<package pkgid="2a952f43e98faaa18b5ebda00b2479d52ba24fd07f7141addb85493b69812a8d" name="kernel-default-base" arch="aarch64">
  <version epoch="0" ver="5.14.21" rel="150500.55.28.1.150500.6.11.2"/>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
  <changelog author="fvogt@suse.com" date="1665144000">- Add _diag modules for included socket types (boo#1204042)</changelog>
  <changelog author="fvogt@suse.com" date="1680004800">- Add exfat (boo#1208822)</changelog>
  <changelog author="msuchanek@suse.com" date="1682337600">- Do not build on s390 (bsc#1210729)</changelog>
</package>
<package pkgid="a05da3a65f0951600b6c1d3afe83127be24ca89b8a241141480e0f34abdc2b4d" name="kernel-default-base" arch="src">
  <version epoch="0" ver="5.14.21" rel="150500.55.28.1.150500.6.11.2"/>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
  <changelog author="fvogt@suse.com" date="1665144000">- Add _diag modules for included socket types (boo#1204042)</changelog>
  <changelog author="fvogt@suse.com" date="1680004800">- Add exfat (boo#1208822)</changelog>
  <changelog author="msuchanek@suse.com" date="1682337600">- Do not build on s390 (bsc#1210729)</changelog>
</package>
<package pkgid="e0bd7f445336cde9e0ee73481c8e46493ff63292cebe60887f84b00657233694" name="kernel-default-base" arch="x86_64">
  <version epoch="0" ver="5.14.21" rel="150500.55.28.1.150500.6.11.2"/>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
  <changelog author="fvogt@suse.com" date="1665144000">- Add _diag modules for included socket types (boo#1204042)</changelog>
  <changelog author="fvogt@suse.com" date="1680004800">- Add exfat (boo#1208822)</changelog>
  <changelog author="msuchanek@suse.com" date="1682337600">- Do not build on s390 (bsc#1210729)</changelog>
</package>
<package pkgid="98664f478f2031e789b732672925bf9076bb95ec3fb947154fb4640c74339a9c" name="kernel-default-base" arch="aarch64">
  <version epoch="0" ver="5.14.21" rel="150500.55.31.1.150500.6.13.1"/>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
  <changelog author="fvogt@suse.com" date="1665144000">- Add _diag modules for included socket types (boo#1204042)</changelog>
  <changelog author="fvogt@suse.com" date="1680004800">- Add exfat (boo#1208822)</changelog>
  <changelog author="msuchanek@suse.com" date="1682337600">- Do not build on s390 (bsc#1210729)</changelog>
</package>
<package pkgid="bff278d72f0ee91c4e9c4ea5dd500c4c6cbafe1b79219ff68d9a1881f55f9e7a" name="kernel-default-base" arch="src">
  <version epoch="0" ver="5.14.21" rel="150500.55.31.1.150500.6.13.1"/>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
  <changelog author="fvogt@suse.com" date="1665144000">- Add _diag modules for included socket types (boo#1204042)</changelog>
  <changelog author="fvogt@suse.com" date="1680004800">- Add exfat (boo#1208822)</changelog>
  <changelog author="msuchanek@suse.com" date="1682337600">- Do not build on s390 (bsc#1210729)</changelog>
</package>
<package pkgid="9c901c434a16362df00c6d85d673b39cd2bc9eaf3bc0042e0c6e8ba0c8cfd344" name="kernel-default-base" arch="x86_64">
  <version epoch="0" ver="5.14.21" rel="150500.55.31.1.150500.6.13.1"/>
  <changelog author="gmoro@suse.com" date="1578571200">- Remove iscsi_ibft (bsc#1157460)</changelog>
  <changelog author="fvogt@suse.com" date="1582027200">- Add the brd module, used by the LTP testsuite and tiny</changelog>
  <changelog author="fvogt@suse.com" date="1582804800">- Add tcp_diag, needed by openslp</changelog>
  <changelog author="msuchanek@suse.de" date="1587470400">- Add qemu_fw_cfg needed by ignition (boo#1170069).</changelog>
  <changelog author="fvogt@suse.com" date="1588593600">- Add hardware-specific crc32c implementations (boo#1171065)</changelog>
  <changelog author="msuchanek@suse.com" date="1589803200">- Add usbhid and hid-generic for USB input devices (boo#1167749)</changelog>
  <changelog author="fvogt@suse.com" date="1589976000">- Add vxlan (bsc#1171903)</changelog>
  <changelog author="fvogt@suse.com" date="1601899200">- Add cifs</changelog>
  <changelog author="fvogt@suse.com" date="1602590400">- Create the list of crypto modules dynamically, supersedes hardcoded
  list of crc32 implementations (boo#1177577)</changelog>
  <changelog author="fvogt@suse.com" date="1606392000">- Add wireguard (boo#1179225)</changelog>
  <changelog author="fvogt@suse.com" date="1613044800">- Add modules which got lost when migrating away from supported.conf
  (bsc#1182110):
  * am53c974 had a typo
  * cls_bpf, iscsi_ibft, libahci, libata, openvswitch, sch_ingress
- Also add vport-* modules for Open vSwitch</changelog>
  <changelog author="fvogt@suse.com" date="1613995200">- Add fuse (boo#1182507)</changelog>
  <changelog author="fvogt@suse.com" date="1613995201">- Add squashfs for kiwi installiso support (bsc#1182341)</changelog>
  <changelog author="fvogt@suse.com" date="1622635200">- Add nfsd for nfs server support (boo#1186363 bsc#1089118)</changelog>
  <changelog author="fvogt@suse.com" date="1633089600">- Add nls_utf8 module (boo#1190797)</changelog>
  <changelog author="fvogt@suse.com" date="1646136000">- Add quota modules (bsc#1196585)
- Add nfs layout modules</changelog>
  <changelog author="fvogt@suse.com" date="1646222400">- Add binfmt_misc (boo#1196373)</changelog>
  <changelog author="fvogt@suse.com" date="1665144000">- Add _diag modules for included socket types (boo#1204042)</changelog>
  <changelog author="fvogt@suse.com" date="1680004800">- Add exfat (boo#1208822)</changelog>
  <changelog author="msuchanek@suse.com" date="1682337600">- Do not build on s390 (bsc#1210729)</changelog>
</package>
<package pkgid="deb1ce50bbeab4e503f9f6b92dcd58b109c980873b3bf3f3b24de24d0cf42d13" name="kernel-rt" arch="src">
  <version epoch="0" ver="5.14.21" rel="150500.13.18.1"/>
  <changelog author="mfranc@suse.cz" date="1694606400">- s390/ipl: add eckd support (jsc#PED-2023).
- commit 21b5156</changelog>
  <changelog author="tiwai@suse.de" date="1694606401">- platform/mellanox: mlxbf-pmc: Fix reading of unprogrammed events
  (git-fixes).
- platform/mellanox: mlxbf-pmc: Fix potential buffer overflows
  (git-fixes).
- platform/mellanox: mlxbf-tmfifo: Drop jumbo frames (git-fixes).
- platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more
  descriptors (git-fixes).
- kselftest/runner.sh: Propagate SIGTERM to runner child
  (git-fixes).
- commit 495d04f</changelog>
  <changelog author="mfranc@suse.cz" date="1694606402">- s390/ipl: add eckd dump support (jsc#PED-2025).
- commit 0961d1f</changelog>
  <changelog author="mfranc@suse.cz" date="1694606403">- kabi: hide changes in enum ipl_type and struct sclp_info
  (jsc#PED-2023 jsc#PED-2025).
- commit b6fb6b6</changelog>
  <changelog author="mfranc@suse.cz" date="1694606404">- s390/ipl: use octal values instead of S_* macros (jsc#PED-2023).
- commit db2ef83</changelog>
  <changelog author="mfranc@suse.cz" date="1694606405">- s390/ipl: add DEFINE_GENERIC_LOADPARM() (jsc#PED-2023).
- commit cd6d27a</changelog>
  <changelog author="mfranc@suse.cz" date="1694606406">- s390/ipl: add loadparm parameter to eckd ipl/reipl data
  (jsc#PED-2023).
- commit 364a30d</changelog>
  <changelog author="mkubecek@suse.cz" date="1694692800">- sctp: leave the err path free in sctp_stream_init to
  sctp_stream_free (CVE-2023-2177 bsc#1210643).
- commit 337b7d8</changelog>
  <changelog author="mkubecek@suse.cz" date="1694779200">- netfilter: nftables: exthdr: fix 4-byte stack OOB write
  (CVE-2023-4881 bsc#1215221).
- commit 0de26c1</changelog>
  <changelog author="jgross@suse.com" date="1694865600">- 9p/xen : Fix use after free bug in xen_9pfs_front_remove due
  to race condition (bsc#1215206, CVE-2023-1859).
- commit f333aa7</changelog>
  <changelog author="wqu@suse.com" date="1695038400">- btrfs: don't hold CPU for too long when defragging a file
  (bsc#1214988).
- commit 9b89645</changelog>
  <changelog author="tiwai@suse.de" date="1695038401">- ata: libata: disallow dev-initiated LPM transitions to
  unsupported states (git-fixes).
- i2c: aspeed: Reset the i2c controller when timeout occurs
  (git-fixes).
- selftests: tracing: Fix to unmount tracefs for recovering
  environment (git-fixes).
- drm/amd/display: fix the white screen issue when &gt;= 64GB DRAM
  (git-fixes).
- drm: gm12u320: Fix the timeout usage for usb_bulk_msg()
  (git-fixes).
- commit 1f4e814</changelog>
  <changelog author="tzimmermann@suse.com" date="1695038402">- blacklist.conf: Append 'parisc/agp: Annotate parisc agp init functions with __init'
- commit 9eb45cc</changelog>
  <changelog author="tzimmermann@suse.com" date="1695038403">- blacklist.conf: Append 'parisc: Flush gatt writes and adjust gatt mask in parisc_agp_mask_memory()'
- commit 30a9db6</changelog>
  <changelog author="tzimmermann@suse.com" date="1695038404">- blacklist.conf: Append 'video/aperture: Only remove sysfb on the default vga pci device'
- commit bfaaaff</changelog>
  <changelog author="tzimmermann@suse.com" date="1695038405">- blacklist.conf: Append 'Revert "fbcon: Use kzalloc() in fbcon_prepare_logo()"'
- commit 501bd2e</changelog>
  <changelog author="osalvador@suse.de" date="1695038406">- Rename colliding patches before merging SLE15-SP4
- commit 6493f7c</changelog>
  <changelog author="jkosina@suse.cz" date="1695297600">- USB: core: Change usb_get_device_descriptor() API (bsc#1213123
  CVE-2023-37453 bsc#1215553 bsc#1215522 bsc#1215552).
  Refresh patches.suse/USB-core-Fix-race-by-not-overwriting-udev-descriptor.patch (add missing hunk)
  Refresh patches.suse/USB-core-Fix-oversight-in-SuperSpeed-initialization.patch (context)
- commit 988a527</changelog>
  <changelog author="osalvador@suse.de" date="1695297601">- Drop amdgpu patch causing spamming (bsc#1215523)
  Deleted:
  patches.suse/drm-amdgpu-install-stub-fence-into-potential-unused-.patch.
- commit c753869</changelog>
  <changelog author="osalvador@suse.de" date="1695384000">- x86/sev: Make enc_dec_hypercall() accept a size instead of
  npages (bsc#1214635).
- commit 1e4ccee</changelog>
</package>
<package pkgid="76a06ecf07a6c53aa61e3ada05b4f9d6941939bae4833997de8ab22660944627" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="5.14.21" rel="150500.13.18.1"/>
  <changelog author="mfranc@suse.cz" date="1694606400">- s390/ipl: add eckd support (jsc#PED-2023).
- commit 21b5156</changelog>
  <changelog author="tiwai@suse.de" date="1694606401">- platform/mellanox: mlxbf-pmc: Fix reading of unprogrammed events
  (git-fixes).
- platform/mellanox: mlxbf-pmc: Fix potential buffer overflows
  (git-fixes).
- platform/mellanox: mlxbf-tmfifo: Drop jumbo frames (git-fixes).
- platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more
  descriptors (git-fixes).
- kselftest/runner.sh: Propagate SIGTERM to runner child
  (git-fixes).
- commit 495d04f</changelog>
  <changelog author="mfranc@suse.cz" date="1694606402">- s390/ipl: add eckd dump support (jsc#PED-2025).
- commit 0961d1f</changelog>
  <changelog author="mfranc@suse.cz" date="1694606403">- kabi: hide changes in enum ipl_type and struct sclp_info
  (jsc#PED-2023 jsc#PED-2025).
- commit b6fb6b6</changelog>
  <changelog author="mfranc@suse.cz" date="1694606404">- s390/ipl: use octal values instead of S_* macros (jsc#PED-2023).
- commit db2ef83</changelog>
  <changelog author="mfranc@suse.cz" date="1694606405">- s390/ipl: add DEFINE_GENERIC_LOADPARM() (jsc#PED-2023).
- commit cd6d27a</changelog>
  <changelog author="mfranc@suse.cz" date="1694606406">- s390/ipl: add loadparm parameter to eckd ipl/reipl data
  (jsc#PED-2023).
- commit 364a30d</changelog>
  <changelog author="mkubecek@suse.cz" date="1694692800">- sctp: leave the err path free in sctp_stream_init to
  sctp_stream_free (CVE-2023-2177 bsc#1210643).
- commit 337b7d8</changelog>
  <changelog author="mkubecek@suse.cz" date="1694779200">- netfilter: nftables: exthdr: fix 4-byte stack OOB write
  (CVE-2023-4881 bsc#1215221).
- commit 0de26c1</changelog>
  <changelog author="jgross@suse.com" date="1694865600">- 9p/xen : Fix use after free bug in xen_9pfs_front_remove due
  to race condition (bsc#1215206, CVE-2023-1859).
- commit f333aa7</changelog>
  <changelog author="wqu@suse.com" date="1695038400">- btrfs: don't hold CPU for too long when defragging a file
  (bsc#1214988).
- commit 9b89645</changelog>
  <changelog author="tiwai@suse.de" date="1695038401">- ata: libata: disallow dev-initiated LPM transitions to
  unsupported states (git-fixes).
- i2c: aspeed: Reset the i2c controller when timeout occurs
  (git-fixes).
- selftests: tracing: Fix to unmount tracefs for recovering
  environment (git-fixes).
- drm/amd/display: fix the white screen issue when &gt;= 64GB DRAM
  (git-fixes).
- drm: gm12u320: Fix the timeout usage for usb_bulk_msg()
  (git-fixes).
- commit 1f4e814</changelog>
  <changelog author="tzimmermann@suse.com" date="1695038402">- blacklist.conf: Append 'parisc/agp: Annotate parisc agp init functions with __init'
- commit 9eb45cc</changelog>
  <changelog author="tzimmermann@suse.com" date="1695038403">- blacklist.conf: Append 'parisc: Flush gatt writes and adjust gatt mask in parisc_agp_mask_memory()'
- commit 30a9db6</changelog>
  <changelog author="tzimmermann@suse.com" date="1695038404">- blacklist.conf: Append 'video/aperture: Only remove sysfb on the default vga pci device'
- commit bfaaaff</changelog>
  <changelog author="tzimmermann@suse.com" date="1695038405">- blacklist.conf: Append 'Revert "fbcon: Use kzalloc() in fbcon_prepare_logo()"'
- commit 501bd2e</changelog>
  <changelog author="osalvador@suse.de" date="1695038406">- Rename colliding patches before merging SLE15-SP4
- commit 6493f7c</changelog>
  <changelog author="jkosina@suse.cz" date="1695297600">- USB: core: Change usb_get_device_descriptor() API (bsc#1213123
  CVE-2023-37453 bsc#1215553 bsc#1215522 bsc#1215552).
  Refresh patches.suse/USB-core-Fix-race-by-not-overwriting-udev-descriptor.patch (add missing hunk)
  Refresh patches.suse/USB-core-Fix-oversight-in-SuperSpeed-initialization.patch (context)
- commit 988a527</changelog>
  <changelog author="osalvador@suse.de" date="1695297601">- Drop amdgpu patch causing spamming (bsc#1215523)
  Deleted:
  patches.suse/drm-amdgpu-install-stub-fence-into-potential-unused-.patch.
- commit c753869</changelog>
  <changelog author="osalvador@suse.de" date="1695384000">- x86/sev: Make enc_dec_hypercall() accept a size instead of
  npages (bsc#1214635).
- commit 1e4ccee</changelog>
</package>
<package pkgid="b6a783ef44ea49fb500fb96b8dbb44f84982f5e20fb452ca5aa6863b85f8d934" name="kernel-rt" arch="src">
  <version epoch="0" ver="5.14.21" rel="150500.13.21.1"/>
  <changelog author="pmladek@suse.com" date="1696248000">- printk: ringbuffer: Fix truncating buffer size min_t cast
  (bsc#1215875).
- commit e0d3999</changelog>
  <changelog author="pmladek@suse.com" date="1696248001">- blacklist.conf: printk: the changes look good but they do not fix
  any serious problem
- commit c560ceb</changelog>
  <changelog author="pmladek@suse.com" date="1696248002">- blacklist.conf: workqueue: Code refactoring
- commit e204334</changelog>
  <changelog author="pmladek@suse.com" date="1696248003">- blacklist.conf: workqueue: compiler warning on 32-bit systems with
  Clang (bsc#1215877)
- commit b7e65aa</changelog>
  <changelog author="mkubecek@suse.cz" date="1696334400">- tcp: Reduce chance of collisions in inet6_hashfn()
  (CVE-2023-1206 bsc#1212703).
- commit e3ebd17</changelog>
  <changelog author="mkubecek@suse.cz" date="1696334401">- netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro
  for ip_set_hash_netportnet.c (CVE-2023-42753 bsc#1215150).
- commit 7a6be79</changelog>
  <changelog author="mfranc@suse.cz" date="1696334402">- KVM: s390: vsie: Fix the initialization of the epoch extension
  (epdx) field (git-fixes bsc#1215894).
- commit 9c5bbd7</changelog>
  <changelog author="mfranc@suse.cz" date="1696334403">- KVM: s390: vsie: fix the length of APCB bitmap (git-fixes
  bsc#1215895).
- commit 9ff1a1e</changelog>
  <changelog author="mfranc@suse.cz" date="1696334404">- KVM: s390: interrupt: use READ_ONCE() before cmpxchg()
  (git-fixes bsc#1215896).
- commit 8726736</changelog>
  <changelog author="mfranc@suse.cz" date="1696334405">- blacklist.conf: kABi breakage (vmalloc)
- commit 10bad47</changelog>
  <changelog author="palcantara@suse.de" date="1696334406">- fs/smb/client: Reset password pointer to NULL (bsc#1215899
  CVE-2023-5345).
- commit 679511d</changelog>
  <changelog author="mfranc@suse.cz" date="1696334407">- KVM: s390/diag: fix racy access of physical cpu number in diag
  9c handler (git-fixes bsc#1215911).
- commit 6454286</changelog>
  <changelog author="mfranc@suse.cz" date="1696334408">- KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
  (git-fixes bsc#1215915).
- commit fe7fbfc</changelog>
  <changelog author="jdelvare@suse.de" date="1696334409">- btrfs: fix root ref counts in error handling in
  btrfs_get_root_ref (bsc#1214351 CVE-2023-4389).
- commit 3731029</changelog>
  <changelog author="mfranc@suse.cz" date="1696334410">- KVM: s390: pv: fix external interruption loop not always
  detected (git-fixes bsc#1215916).
- commit f1893aa</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420800">- ipv4: fix null-deref in ipv4_link_failure (CVE-2023-42754
  bsc#1215467).
- commit ad87dd3</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420801">- netfilter: xt_u32: validate user space input (CVE-2023-39192
  bsc#1215858).
- commit 292c059</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420802">- netfilter: xt_sctp: validate the flag_info count (CVE-2023-39193
  bsc#1215860).
- commit 5ec24b7</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420803">- net: xfrm: Fix xfrm_address_filter OOB read (CVE-2023-39194
  bsc#1215861).
- commit 55308cb</changelog>
  <changelog author="mfranc@suse.cz" date="1696420804">- scsi: zfcp: Fix a double put in zfcp_port_enqueue() (git-fixes
  bsc#1215941).
- commit a62865f</changelog>
</package>
<package pkgid="e8aec2aac1b612ad2953298e26a38b6cc3834bce4813b5ada63e5fd73fcfb67b" name="kernel-rt" arch="x86_64">
  <version epoch="0" ver="5.14.21" rel="150500.13.21.1"/>
  <changelog author="pmladek@suse.com" date="1696248000">- printk: ringbuffer: Fix truncating buffer size min_t cast
  (bsc#1215875).
- commit e0d3999</changelog>
  <changelog author="pmladek@suse.com" date="1696248001">- blacklist.conf: printk: the changes look good but they do not fix
  any serious problem
- commit c560ceb</changelog>
  <changelog author="pmladek@suse.com" date="1696248002">- blacklist.conf: workqueue: Code refactoring
- commit e204334</changelog>
  <changelog author="pmladek@suse.com" date="1696248003">- blacklist.conf: workqueue: compiler warning on 32-bit systems with
  Clang (bsc#1215877)
- commit b7e65aa</changelog>
  <changelog author="mkubecek@suse.cz" date="1696334400">- tcp: Reduce chance of collisions in inet6_hashfn()
  (CVE-2023-1206 bsc#1212703).
- commit e3ebd17</changelog>
  <changelog author="mkubecek@suse.cz" date="1696334401">- netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro
  for ip_set_hash_netportnet.c (CVE-2023-42753 bsc#1215150).
- commit 7a6be79</changelog>
  <changelog author="mfranc@suse.cz" date="1696334402">- KVM: s390: vsie: Fix the initialization of the epoch extension
  (epdx) field (git-fixes bsc#1215894).
- commit 9c5bbd7</changelog>
  <changelog author="mfranc@suse.cz" date="1696334403">- KVM: s390: vsie: fix the length of APCB bitmap (git-fixes
  bsc#1215895).
- commit 9ff1a1e</changelog>
  <changelog author="mfranc@suse.cz" date="1696334404">- KVM: s390: interrupt: use READ_ONCE() before cmpxchg()
  (git-fixes bsc#1215896).
- commit 8726736</changelog>
  <changelog author="mfranc@suse.cz" date="1696334405">- blacklist.conf: kABi breakage (vmalloc)
- commit 10bad47</changelog>
  <changelog author="palcantara@suse.de" date="1696334406">- fs/smb/client: Reset password pointer to NULL (bsc#1215899
  CVE-2023-5345).
- commit 679511d</changelog>
  <changelog author="mfranc@suse.cz" date="1696334407">- KVM: s390/diag: fix racy access of physical cpu number in diag
  9c handler (git-fixes bsc#1215911).
- commit 6454286</changelog>
  <changelog author="mfranc@suse.cz" date="1696334408">- KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
  (git-fixes bsc#1215915).
- commit fe7fbfc</changelog>
  <changelog author="jdelvare@suse.de" date="1696334409">- btrfs: fix root ref counts in error handling in
  btrfs_get_root_ref (bsc#1214351 CVE-2023-4389).
- commit 3731029</changelog>
  <changelog author="mfranc@suse.cz" date="1696334410">- KVM: s390: pv: fix external interruption loop not always
  detected (git-fixes bsc#1215916).
- commit f1893aa</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420800">- ipv4: fix null-deref in ipv4_link_failure (CVE-2023-42754
  bsc#1215467).
- commit ad87dd3</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420801">- netfilter: xt_u32: validate user space input (CVE-2023-39192
  bsc#1215858).
- commit 292c059</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420802">- netfilter: xt_sctp: validate the flag_info count (CVE-2023-39193
  bsc#1215860).
- commit 5ec24b7</changelog>
  <changelog author="mkubecek@suse.cz" date="1696420803">- net: xfrm: Fix xfrm_address_filter OOB read (CVE-2023-39194
  bsc#1215861).
- commit 55308cb</changelog>
  <changelog author="mfranc@suse.cz" date="1696420804">- scsi: zfcp: Fix a double put in zfcp_port_enqueue() (git-fixes
  bsc#1215941).
- commit a62865f</changelog>
</package>
<package pkgid="757c67318addcf8c2e78fe63674fb44ac003d32fdd86d08d4377ef8cb44c129c" name="kubevirt" arch="src">
  <version epoch="0" ver="1.0.0" rel="150500.8.3.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1645444800">- Allow to configure utility containers for update test
  0001-improve-kubevirt-update-test.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1645531200">- Drop kubevirt-psp-caasp.yaml</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Use semantic equality comparison
  0002-use-semantic-equality-comparison.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393601">- Avoid to return nil failure message
  0003-Avoid-to-return-nil-failure-message.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393602">- Increase storage requirements in _constraints
- Pack nft rules and nsswitch.conf for virt-handler
- Only create 1MiB-aligned disk images (bsc#1199603)
  0004-only-create-1MiB-aligned-disk-images.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1655899200">- Update to version 0.54.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0
- Drop upstreamed patches
  0001-improve-kubevirt-update-test.patch
  0002-use-semantic-equality-comparison.patch
  0003-Avoid-to-return-nil-failure-message.patch
  0004-only-create-1MiB-aligned-disk-images.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Add CVE fixes
  0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528)
  0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460)
  0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1659528000">- Update libvirt-go to fix memory leak
  0004-Update-libvirt-go-to-fix-memory-leak.patch
- Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516)
  0005-Improve-non-root-path-handling</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1659960000">- Support topology spread constraints
  0006-topology-spread-constraints.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1661947200">- Fix containerdisk unmount logic
  0007-Fix-containerdisk-unmount-logic.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 0.57.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0
- Drop upstreamed patches:
  0001-Bump-the-version-of-go-restful-to-2.16.0.patch
  0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch
  0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch
  0004-Update-libvirt-go-to-fix-memory-leak.patch
  0005-Improve-non-root-path-handling
  0006-topology-spread-constraints.patch
  0007-Fix-containerdisk-unmount-logic.patch
- Build new packages: virt-exportproxy and virt-exportserver
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665748800">- Update to version 0.58.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1670500800">- Fix libguestfs pod startup error
  0001-guestfs-flag-to-set-uid-and-gid.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1671537600">- Use JSON syntax for slirp device
  0002-network-Use-JSON-syntax-for-slirp-device.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1678968000">- Use recent golang compiler (bsc#1208916)
- Limit operator secrets permission (CVE-2023-26484, bsc#1209359)
  0003-Vulnerability-fix-limit-operator-secrets-permission.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1683028800">- TSC frequencies: add 250PPM tolerance (bsc#1210906)
  0004-TSC-frequencies-add-250PPM-tolerance.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689940800">- Update to version 1.0.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0
- Drop patches
  0001-guestfs-flag-to-set-uid-and-gid.patch
  0002-network-Use-JSON-syntax-for-slirp-device.patch
  0003-Vulnerability-fix-limit-operator-secrets-permission.patch
  0004-TSC-frequencies-add-250PPM-tolerance.patch
- Add patches
  0001-Fix-qemu-system-lookup.patch
  0002-ksm-Access-sysfs-from-the-host-filesystem.patch
  0003-Virtiofs-Remove-duplicated-functional-tests.patch
  0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch
- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1690286400">- Use compat cmdline options for virtiofsd
  0005-Use-compat-cmdline-options-for-virtiofsd.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1693224000">- Fix leaking file descriptor
  0006-isolation-close-file-when-exits.patch
- Fix volume detach on hotplug attachment pod delete
  0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch
- Fix leaking tickers
  0008-fix-ticker-leak.patch
- Run helper pod as qemu user
  0009-tests-Run-helper-pod-as-qemu-107-user.patch
- SCSI reservation: fix leftover mount and resource permissions
  0010-Fix-PR-leftover-mount-and-perms.patch
- Bump client-go (fix possible panic in discovery)
  0011-Fix-Aggregated-Discovery.patch
- Wait for new hotplug attachment pod to be ready
  0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch
- Adapt the storage tests to the new populators flow
  0013-Adapt-e2e-tests-to-CDI-1.57.0.patch
- Create export VM datavolumes compatible with populators
  0014-Export-create-populator-compatible-datavolumes-from-.patch
- Delete VMI prior to NFS server pod in tests
  0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch</changelog>
</package>
<package pkgid="14f76f3c1eedb6d1d0db32372db92a2293a781d7da82d43fde2912e91dccb9e8" name="kubevirt-manifests" arch="x86_64">
  <version epoch="0" ver="1.0.0" rel="150500.8.3.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1645444800">- Allow to configure utility containers for update test
  0001-improve-kubevirt-update-test.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1645531200">- Drop kubevirt-psp-caasp.yaml</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Use semantic equality comparison
  0002-use-semantic-equality-comparison.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393601">- Avoid to return nil failure message
  0003-Avoid-to-return-nil-failure-message.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393602">- Increase storage requirements in _constraints
- Pack nft rules and nsswitch.conf for virt-handler
- Only create 1MiB-aligned disk images (bsc#1199603)
  0004-only-create-1MiB-aligned-disk-images.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1655899200">- Update to version 0.54.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0
- Drop upstreamed patches
  0001-improve-kubevirt-update-test.patch
  0002-use-semantic-equality-comparison.patch
  0003-Avoid-to-return-nil-failure-message.patch
  0004-only-create-1MiB-aligned-disk-images.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Add CVE fixes
  0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528)
  0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460)
  0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1659528000">- Update libvirt-go to fix memory leak
  0004-Update-libvirt-go-to-fix-memory-leak.patch
- Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516)
  0005-Improve-non-root-path-handling</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1659960000">- Support topology spread constraints
  0006-topology-spread-constraints.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1661947200">- Fix containerdisk unmount logic
  0007-Fix-containerdisk-unmount-logic.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 0.57.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0
- Drop upstreamed patches:
  0001-Bump-the-version-of-go-restful-to-2.16.0.patch
  0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch
  0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch
  0004-Update-libvirt-go-to-fix-memory-leak.patch
  0005-Improve-non-root-path-handling
  0006-topology-spread-constraints.patch
  0007-Fix-containerdisk-unmount-logic.patch
- Build new packages: virt-exportproxy and virt-exportserver
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665748800">- Update to version 0.58.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1670500800">- Fix libguestfs pod startup error
  0001-guestfs-flag-to-set-uid-and-gid.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1671537600">- Use JSON syntax for slirp device
  0002-network-Use-JSON-syntax-for-slirp-device.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1678968000">- Use recent golang compiler (bsc#1208916)
- Limit operator secrets permission (CVE-2023-26484, bsc#1209359)
  0003-Vulnerability-fix-limit-operator-secrets-permission.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1683028800">- TSC frequencies: add 250PPM tolerance (bsc#1210906)
  0004-TSC-frequencies-add-250PPM-tolerance.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689940800">- Update to version 1.0.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0
- Drop patches
  0001-guestfs-flag-to-set-uid-and-gid.patch
  0002-network-Use-JSON-syntax-for-slirp-device.patch
  0003-Vulnerability-fix-limit-operator-secrets-permission.patch
  0004-TSC-frequencies-add-250PPM-tolerance.patch
- Add patches
  0001-Fix-qemu-system-lookup.patch
  0002-ksm-Access-sysfs-from-the-host-filesystem.patch
  0003-Virtiofs-Remove-duplicated-functional-tests.patch
  0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch
- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1690286400">- Use compat cmdline options for virtiofsd
  0005-Use-compat-cmdline-options-for-virtiofsd.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1693224000">- Fix leaking file descriptor
  0006-isolation-close-file-when-exits.patch
- Fix volume detach on hotplug attachment pod delete
  0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch
- Fix leaking tickers
  0008-fix-ticker-leak.patch
- Run helper pod as qemu user
  0009-tests-Run-helper-pod-as-qemu-107-user.patch
- SCSI reservation: fix leftover mount and resource permissions
  0010-Fix-PR-leftover-mount-and-perms.patch
- Bump client-go (fix possible panic in discovery)
  0011-Fix-Aggregated-Discovery.patch
- Wait for new hotplug attachment pod to be ready
  0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch
- Adapt the storage tests to the new populators flow
  0013-Adapt-e2e-tests-to-CDI-1.57.0.patch
- Create export VM datavolumes compatible with populators
  0014-Export-create-populator-compatible-datavolumes-from-.patch
- Delete VMI prior to NFS server pod in tests
  0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch</changelog>
</package>
<package pkgid="ac30890a4499cf326783f22b3ae18151f206ce550fa171e3f9eb4d7fc512395e" name="kubevirt-virtctl" arch="x86_64">
  <version epoch="0" ver="1.0.0" rel="150500.8.3.1"/>
  <changelog author="vasily.ulyanov@suse.com" date="1645444800">- Allow to configure utility containers for update test
  0001-improve-kubevirt-update-test.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1645531200">- Drop kubevirt-psp-caasp.yaml</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393600">- Use semantic equality comparison
  0002-use-semantic-equality-comparison.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393601">- Avoid to return nil failure message
  0003-Avoid-to-return-nil-failure-message.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1653393602">- Increase storage requirements in _constraints
- Pack nft rules and nsswitch.conf for virt-handler
- Only create 1MiB-aligned disk images (bsc#1199603)
  0004-only-create-1MiB-aligned-disk-images.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1655899200">- Update to version 0.54.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.54.0
- Drop upstreamed patches
  0001-improve-kubevirt-update-test.patch
  0002-use-semantic-equality-comparison.patch
  0003-Avoid-to-return-nil-failure-message.patch
  0004-only-create-1MiB-aligned-disk-images.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1658923200">- Add CVE fixes
  0001-Bump-the-version-of-go-restful-to-2.16.0.patch (CVE-2022-1996, bsc#1200528)
  0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch (CVE-2022-29162, bsc#1199460)
  0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1659528000">- Update libvirt-go to fix memory leak
  0004-Update-libvirt-go-to-fix-memory-leak.patch
- Fix arbitrary file read on the host from KubeVirt VMs (CVE-2022-1798, bsc#1202516)
  0005-Improve-non-root-path-handling</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1659960000">- Support topology spread constraints
  0006-topology-spread-constraints.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1661947200">- Fix containerdisk unmount logic
  0007-Fix-containerdisk-unmount-logic.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665403200">- Update to version 0.57.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.57.0
- Drop upstreamed patches:
  0001-Bump-the-version-of-go-restful-to-2.16.0.patch
  0002-CVE-2022-29162-Bump-runc-dependency-to-1.1.2.patch
  0003-Update-the-cgroup-tests-for-the-new-changes-in-runc-.patch
  0004-Update-libvirt-go-to-fix-memory-leak.patch
  0005-Improve-non-root-path-handling
  0006-topology-spread-constraints.patch
  0007-Fix-containerdisk-unmount-logic.patch
- Build new packages: virt-exportproxy and virt-exportserver
- Update SP5 kubevirt registry path (bsc#1204140)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665748800">- Update to version 0.58.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v0.58.0</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1669896000">- Ensure RPMs and containers are built against the same distro
- Be more strict when discovering the registry path: error out if the
  distro is unknown, instead of falling through to 'opensuse' by
  default</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1670500800">- Fix libguestfs pod startup error
  0001-guestfs-flag-to-set-uid-and-gid.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1671537600">- Use JSON syntax for slirp device
  0002-network-Use-JSON-syntax-for-slirp-device.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1678968000">- Use recent golang compiler (bsc#1208916)
- Limit operator secrets permission (CVE-2023-26484, bsc#1209359)
  0003-Vulnerability-fix-limit-operator-secrets-permission.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1683028800">- TSC frequencies: add 250PPM tolerance (bsc#1210906)
  0004-TSC-frequencies-add-250PPM-tolerance.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1689940800">- Update to version 1.0.0
  Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.0.0
- Drop patches
  0001-guestfs-flag-to-set-uid-and-gid.patch
  0002-network-Use-JSON-syntax-for-slirp-device.patch
  0003-Vulnerability-fix-limit-operator-secrets-permission.patch
  0004-TSC-frequencies-add-250PPM-tolerance.patch
- Add patches
  0001-Fix-qemu-system-lookup.patch
  0002-ksm-Access-sysfs-from-the-host-filesystem.patch
  0003-Virtiofs-Remove-duplicated-functional-tests.patch
  0004-tests-leave-some-space-for-metadata-on-the-backend-P.patch
- Add registry path for SLE15 SP6</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1690286400">- Use compat cmdline options for virtiofsd
  0005-Use-compat-cmdline-options-for-virtiofsd.patch</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1693224000">- Fix leaking file descriptor
  0006-isolation-close-file-when-exits.patch
- Fix volume detach on hotplug attachment pod delete
  0007-Fix-volume-detach-on-hotplug-attachment-pod-delete.patch
- Fix leaking tickers
  0008-fix-ticker-leak.patch
- Run helper pod as qemu user
  0009-tests-Run-helper-pod-as-qemu-107-user.patch
- SCSI reservation: fix leftover mount and resource permissions
  0010-Fix-PR-leftover-mount-and-perms.patch
- Bump client-go (fix possible panic in discovery)
  0011-Fix-Aggregated-Discovery.patch
- Wait for new hotplug attachment pod to be ready
  0012-Wait-for-new-hotplug-attachment-pod-to-be-ready.patch
- Adapt the storage tests to the new populators flow
  0013-Adapt-e2e-tests-to-CDI-1.57.0.patch
- Create export VM datavolumes compatible with populators
  0014-Export-create-populator-compatible-datavolumes-from-.patch
- Delete VMI prior to NFS server pod in tests
  0015-tests-Delete-VMI-prior-to-NFS-server-pod.patch</changelog>
</package>
<package pkgid="f5f6ce7f85e83103dd76c8b1cfca2799c0ce699ac89da885f70706cac6b52159" name="libX11" arch="src">
  <version epoch="0" ver="1.6.5" rel="150000.3.33.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1378728000">- Update to version 1.6.2:
  This release of libX11 includes a number of fixes to handle realloc() failure
  better, resolves a number of compiler &amp; static analyzer warnings, fixes several
  bugs in the X Input Method framework, and cleans up the XKB code to be a little
  more maintainable.
- Drop upstreamed patches:
  + Patch10: bug-239698_libx11.diff
  + Patch13: bug-221326-xim-sync.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1395662400">- U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch
  * fix typo in en_US Compose file (s/dead_actute/dead_acute/)
    (bnc#869333)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "Ș"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "ș"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "Ț"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "ț"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
  <changelog author="sndirsch@suse.com" date="1677844800">- U_Don-t-try-to-destroy-NULL-condition-variables.patch
  * fixes regression introduced with security update for
    CVE-2022-3555 (bsc#1204425, bsc#1208881)</changelog>
  <changelog author="sndirsch@suse.com" date="1686571200">- U_InitExt.c-Add-bounds-checks-for-extension-request-ev.patch
  * Buffer overflows in InitExt.c (boo#1212102, CVE-2023-3138)</changelog>
  <changelog author="sndirsch@suse.com" date="1695816000">- U_0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch
  U_0002-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch
  U_0003-XPutImage-clip-images-to-maximum-height-width-allowe.patch
  U_0004-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch
  U_0005-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch
  * CVE-2023-43785 libX11: out-of-bounds memory access in
    _XkbReadKeySyms() (boo#1215683)
  * CVE-2023-43786 libX11: stack exhaustion from infinite recursion
  in PutSubImage() (boo#1215684)
  * CVE-2023-43787 libX11: integer overflow in XCreateImage()
    leading to a heap overflow (boo#1215685)</changelog>
</package>
<package pkgid="de9f9fe22fb4268565a310a62316ba8737096c3b5466ba49ae206e402ecfd65b" name="libX11-6" arch="aarch64">
  <version epoch="0" ver="1.6.5" rel="150000.3.33.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "Ș"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "ș"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "Ț"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "ț"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
  <changelog author="sndirsch@suse.com" date="1677844800">- U_Don-t-try-to-destroy-NULL-condition-variables.patch
  * fixes regression introduced with security update for
    CVE-2022-3555 (bsc#1204425, bsc#1208881)</changelog>
  <changelog author="sndirsch@suse.com" date="1686571200">- U_InitExt.c-Add-bounds-checks-for-extension-request-ev.patch
  * Buffer overflows in InitExt.c (boo#1212102, CVE-2023-3138)</changelog>
  <changelog author="sndirsch@suse.com" date="1695816000">- U_0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch
  U_0002-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch
  U_0003-XPutImage-clip-images-to-maximum-height-width-allowe.patch
  U_0004-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch
  U_0005-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch
  * CVE-2023-43785 libX11: out-of-bounds memory access in
    _XkbReadKeySyms() (boo#1215683)
  * CVE-2023-43786 libX11: stack exhaustion from infinite recursion
  in PutSubImage() (boo#1215684)
  * CVE-2023-43787 libX11: integer overflow in XCreateImage()
    leading to a heap overflow (boo#1215685)</changelog>
</package>
<package pkgid="9975584c06db530ee59e809c369d62416d273bc36c289b15375184632901e060" name="libX11-6" arch="s390x">
  <version epoch="0" ver="1.6.5" rel="150000.3.33.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "Ș"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "ș"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "Ț"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "ț"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
  <changelog author="sndirsch@suse.com" date="1677844800">- U_Don-t-try-to-destroy-NULL-condition-variables.patch
  * fixes regression introduced with security update for
    CVE-2022-3555 (bsc#1204425, bsc#1208881)</changelog>
  <changelog author="sndirsch@suse.com" date="1686571200">- U_InitExt.c-Add-bounds-checks-for-extension-request-ev.patch
  * Buffer overflows in InitExt.c (boo#1212102, CVE-2023-3138)</changelog>
  <changelog author="sndirsch@suse.com" date="1695816000">- U_0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch
  U_0002-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch
  U_0003-XPutImage-clip-images-to-maximum-height-width-allowe.patch
  U_0004-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch
  U_0005-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch
  * CVE-2023-43785 libX11: out-of-bounds memory access in
    _XkbReadKeySyms() (boo#1215683)
  * CVE-2023-43786 libX11: stack exhaustion from infinite recursion
  in PutSubImage() (boo#1215684)
  * CVE-2023-43787 libX11: integer overflow in XCreateImage()
    leading to a heap overflow (boo#1215685)</changelog>
</package>
<package pkgid="091b7a4e7b57eaf46901b5fadf94cf159136f38a8a37c358924a01948766614a" name="libX11-6" arch="x86_64">
  <version epoch="0" ver="1.6.5" rel="150000.3.33.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "Ș"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "ș"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "Ț"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "ț"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
  <changelog author="sndirsch@suse.com" date="1677844800">- U_Don-t-try-to-destroy-NULL-condition-variables.patch
  * fixes regression introduced with security update for
    CVE-2022-3555 (bsc#1204425, bsc#1208881)</changelog>
  <changelog author="sndirsch@suse.com" date="1686571200">- U_InitExt.c-Add-bounds-checks-for-extension-request-ev.patch
  * Buffer overflows in InitExt.c (boo#1212102, CVE-2023-3138)</changelog>
  <changelog author="sndirsch@suse.com" date="1695816000">- U_0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch
  U_0002-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch
  U_0003-XPutImage-clip-images-to-maximum-height-width-allowe.patch
  U_0004-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch
  U_0005-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch
  * CVE-2023-43785 libX11: out-of-bounds memory access in
    _XkbReadKeySyms() (boo#1215683)
  * CVE-2023-43786 libX11: stack exhaustion from infinite recursion
  in PutSubImage() (boo#1215684)
  * CVE-2023-43787 libX11: integer overflow in XCreateImage()
    leading to a heap overflow (boo#1215685)</changelog>
</package>
<package pkgid="40043ca918cf34ad6a925de041020b875f95b1fb4eba167a73e65652b32a5551" name="libX11-data" arch="noarch">
  <version epoch="0" ver="1.6.5" rel="150000.3.33.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "Ș"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "ș"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "Ț"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "ț"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
  <changelog author="sndirsch@suse.com" date="1677844800">- U_Don-t-try-to-destroy-NULL-condition-variables.patch
  * fixes regression introduced with security update for
    CVE-2022-3555 (bsc#1204425, bsc#1208881)</changelog>
  <changelog author="sndirsch@suse.com" date="1686571200">- U_InitExt.c-Add-bounds-checks-for-extension-request-ev.patch
  * Buffer overflows in InitExt.c (boo#1212102, CVE-2023-3138)</changelog>
  <changelog author="sndirsch@suse.com" date="1695816000">- U_0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch
  U_0002-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch
  U_0003-XPutImage-clip-images-to-maximum-height-width-allowe.patch
  U_0004-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch
  U_0005-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch
  * CVE-2023-43785 libX11: out-of-bounds memory access in
    _XkbReadKeySyms() (boo#1215683)
  * CVE-2023-43786 libX11: stack exhaustion from infinite recursion
  in PutSubImage() (boo#1215684)
  * CVE-2023-43787 libX11: integer overflow in XCreateImage()
    leading to a heap overflow (boo#1215685)</changelog>
</package>
<package pkgid="79753d4ab87d404262c9ec674289d0912b06e31744a5d63b5899d60e5ac2de42" name="libX11-xcb1" arch="aarch64">
  <version epoch="0" ver="1.6.5" rel="150000.3.33.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "Ș"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "ș"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "Ț"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "ț"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
  <changelog author="sndirsch@suse.com" date="1677844800">- U_Don-t-try-to-destroy-NULL-condition-variables.patch
  * fixes regression introduced with security update for
    CVE-2022-3555 (bsc#1204425, bsc#1208881)</changelog>
  <changelog author="sndirsch@suse.com" date="1686571200">- U_InitExt.c-Add-bounds-checks-for-extension-request-ev.patch
  * Buffer overflows in InitExt.c (boo#1212102, CVE-2023-3138)</changelog>
  <changelog author="sndirsch@suse.com" date="1695816000">- U_0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch
  U_0002-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch
  U_0003-XPutImage-clip-images-to-maximum-height-width-allowe.patch
  U_0004-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch
  U_0005-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch
  * CVE-2023-43785 libX11: out-of-bounds memory access in
    _XkbReadKeySyms() (boo#1215683)
  * CVE-2023-43786 libX11: stack exhaustion from infinite recursion
  in PutSubImage() (boo#1215684)
  * CVE-2023-43787 libX11: integer overflow in XCreateImage()
    leading to a heap overflow (boo#1215685)</changelog>
</package>
<package pkgid="8d1ff75268b669793bc0850b9dbbd6497d64260b8cee1c95e2ecf839ac6c94e5" name="libX11-xcb1" arch="s390x">
  <version epoch="0" ver="1.6.5" rel="150000.3.33.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "Ș"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "ș"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "Ț"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "ț"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
  <changelog author="sndirsch@suse.com" date="1677844800">- U_Don-t-try-to-destroy-NULL-condition-variables.patch
  * fixes regression introduced with security update for
    CVE-2022-3555 (bsc#1204425, bsc#1208881)</changelog>
  <changelog author="sndirsch@suse.com" date="1686571200">- U_InitExt.c-Add-bounds-checks-for-extension-request-ev.patch
  * Buffer overflows in InitExt.c (boo#1212102, CVE-2023-3138)</changelog>
  <changelog author="sndirsch@suse.com" date="1695816000">- U_0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch
  U_0002-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch
  U_0003-XPutImage-clip-images-to-maximum-height-width-allowe.patch
  U_0004-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch
  U_0005-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch
  * CVE-2023-43785 libX11: out-of-bounds memory access in
    _XkbReadKeySyms() (boo#1215683)
  * CVE-2023-43786 libX11: stack exhaustion from infinite recursion
  in PutSubImage() (boo#1215684)
  * CVE-2023-43787 libX11: integer overflow in XCreateImage()
    leading to a heap overflow (boo#1215685)</changelog>
</package>
<package pkgid="9b2034ab43589e1c33401f316c299753c84ee4f07b843e406e5b4eab365b240d" name="libX11-xcb1" arch="x86_64">
  <version epoch="0" ver="1.6.5" rel="150000.3.33.1"/>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1426075200">- Update to version 1.6.3:
  This release of libX11 looks bigger than it is, due to a lot of spec/doc
  cleanup work that doesn't affect the code itself.  There is still a good
  deal of bug fixes, code cleanup, locale improvements, and compose key table
  additions, including new UTF-8 compose sequences for:
  + &lt;Multi_key&gt; &lt;R&gt; &lt;equal&gt;      : "&lt;U+20B9&gt;" U20b9 # INDIAN RUPEE SIGN
  + &lt;Multi_key&gt; &lt;S&gt; &lt;semicolon&gt;  : "Ș"   U0218  # LATIN CAPITAL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;s&gt; &lt;semicolon&gt;  : "ș"   U0219  # LATIN SMALL LETTER S WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;T&gt; &lt;semicolon&gt;  : "Ț"   U021A  # LATIN CAPITAL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;t&gt; &lt;semicolon&gt;  : "ț"   U021B  # LATIN SMALL LETTER T WITH COMMA BELOW
  + &lt;Multi_key&gt; &lt;F&gt; &lt;U&gt;          : "&lt;U+1F595&gt;"  U1F595 # REVERSED HAND WITH MIDDLE FINGER EXTENDED
  + &lt;Multi_key&gt; &lt;L&gt; &lt;L&gt; &lt;A&gt; &lt;P&gt;  : "&lt;U+1F596&gt;"  U1F596 # RAISED HAND WITH PART BETWEEN MIDDLE AND RING FINGERS
- Changes to package:
  + remove Patch16: U_nls-en_US.UTF-8-Compose.pre-Fix-typo.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1426161600">- marked baselibs.conf as source file in specfile</changelog>
  <changelog author="msrb@suse.com" date="1448280000">- U_fix_for_Xlib_32-bit_request_number_issues.patch
  * Fix for overflow of requet number on 32bit platforms.
    (bnc#845916)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1477742400">- Update to version 1.6.4:
  + Move Compose \ o / to be with other emoji compose sequences
  + Replace Xmalloc+memset pairs with Xcalloc calls
  + Remove unused definition of XCONN_CHECK_FREQ
  + Bug 93184: read_EncodingInfo invalid free
  + Bug 93183: _XDefaultOpenIM memory leaks in out-of-memory error paths
  + Use strdup instead of Xmalloc+strcpy in _XDefaultOpenIM
  + XDefaultOMIF: replace strlen+Xmalloc+strcpy with strdup, code simplification
  + XlcDL.c: replace strcpy+strcat sequences with snprintf
  + XlcDL.c: reduce code duplication
  + lcPubWrap: replace malloc(strlen) + strcpy with strdup
  + Stop checking XTRANS_SECURE_RPC_FLAGS since we no longer use them
  + Stop checking for preferred order of local transports
  + Don't need to link libX11-xcb against libX11
  + xcms: use size_t for strlen/sizeof values instead of converting to int &amp; back
  + xcms: use unsigned indexes when looping through unsigned values
  + xcms: use size_t for pointer offsets passed to strncmp
  + omGeneric.c: Correct the parameter usage of sizeof
  + fix for Xlib 32-bit request number issues
  + Add Compose sequence for U+1F4A9.
  + Xlib.h: Fix macros imitating C functions.
  + Add compose file for pt_PT similar to pt_BR
  + Mark _XNextRequest as hidden
  + New compose keys for local languages in Togo
  + Fixup param specification for XChangeProperty()
- Package changes:
  + Remove upstream patch U_fix_for_Xlib_32-bit_request_number_issues.patch</changelog>
  <changelog author="jengelh@inai.de" date="1478347200">- Run fdupes over at least the manpages</changelog>
  <changelog author="sndirsch@suse.com" date="1478606400">- u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch
  * refix cs_CZ.UTF-locale (boo#1008951, fdo#81875, fdo#98219)</changelog>
  <changelog author="tobias.johannes.klausmann@mni.thm.de" date="1488369600">- Update to version 1.6.5:
  + Revert "Compose sequences for rouble sign"
  + specs/libX11: More synopsis fixes
  + specs/libX11: Fix paramdef entries listing multiple parameters
  + specs/libX11: Make paramdef spacing more consistent
  + specs/libX11: Add missing parameter types for XGetWindowProperty()
  + specs/libX11: Fix broken synopsis for Data/Data16/Data32
  + specs/libX11: Update Portability Considerations for the 21st century
  + autogen.sh: use quoted string variables
  + Plug a memory leak
  + Fix wrong Xfree in XListFonts failure path
  + Typos in "Xlib - C Language X Interface" document - Chapter 02
  + autogen: add default patch prefix
  + Compose sequences for rouble sign
  + autogen.sh: use exec instead of waiting for configure to finish
  + Revert cs_CZ.UTF-8 XLC_LOCALE to en_US.UTF-8
- supersedes u_nls-fix-handling-of-cs_CZ.UTF8_locale.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1532433600">- u_off-by-one-write-in-XListExtensions.patch
  * fixes off-by-one write in XListExtensions (bsc#1102062, CVE-2018-14599)
- u_out-of-boundary-write-in-XListExtensions.patch
  * fixes out of boundary write in XListExtensions (bsc#1102068, CVE-2018-14600)
- u_crash-on-invalid-reply-in-XListExtensions.patch
  * crash on invalid reply in XListExtensions (bsc#1102073, CVE-2018-14598)</changelog>
  <changelog author="sndirsch@suse.com" date="1596110400">- U_001-ChangeTheData_lenParameterOf_XimAttributeToValueToCARD16.patch,
  U_002-FixIntegerOverflowsIn_XimAttributeToValue.patch,
  U_003-FixMoreUncheckedLengths.patch,
  U_004-FixSignedLengthValuesIn_XimGetAttributeID.patch,
  U_005-ZeroOutBuffersInFunctions.patch,
  * XIM client heap overflows (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="tiwai@suse.de" date="1596542400">- U_006-Fix-size-calculation-in-_XimAttributeToValue.patch:
  * Regression fix in previous XIM client head overflow fixes
    (CVE-2020-14344, bsc#1174628)</changelog>
  <changelog author="sndirsch@suse.com" date="1598356800">- U_0001-Fix-an-integer-overflow-in-init_om.patch
  * Fix an integer overflow in init_om() [CVE-2020-14363, boo#1175239]</changelog>
  <changelog author="sndirsch@suse.com" date="1612958400">- U_0001-_XIOError-dpy-will-never-return-so-remore-dead.patch
  U_0002-remove-empty-line.patch
  U_0003-poll_for_response-Call-poll_for_event-again-if-xcb_p.patch
  U_0004-poll_for_event-Allow-using-xcb_poll_for_queued_event.patch
  U_0005-Prepare-for-_XIOError-possibly-returning.patch
  U_0006-Fix-poll_for_response-race-condition.patch
  * fixes a race condition in libX11 that causes various
    applications to crash randomly (boo#1181963)
- refreshed U_0001-Fix-an-integer-overflow-in-init_om.patch</changelog>
  <changelog author="sndirsch@suse.com" date="1621252800">-  U_CVE-2021-31535.patch
  * adds missing request length checks in libX11 (CVE-2021-31535,
    bsc#1182506)</changelog>
  <changelog author="sndirsch@suse.com" date="1622462400">- redone U_CVE-2021-31535.patch due to regressions (boo#1186643)
  * fixes segfaults for xforms applications like fdesign</changelog>
  <changelog author="sndirsch@suse.com" date="1666180800">- U_fix-a-memory-leak-in-XRegisterIMInstantiateCallback.patch
  * security update for CVE-2022-3554 (bsc#1204422)
- U_Fix-two-memory-leaks-in-_XFreeX11XCBStructure.patch
  * security update for CVE-2022-3555 (bsc#1204425)</changelog>
  <changelog author="sndirsch@suse.com" date="1677844800">- U_Don-t-try-to-destroy-NULL-condition-variables.patch
  * fixes regression introduced with security update for
    CVE-2022-3555 (bsc#1204425, bsc#1208881)</changelog>
  <changelog author="sndirsch@suse.com" date="1686571200">- U_InitExt.c-Add-bounds-checks-for-extension-request-ev.patch
  * Buffer overflows in InitExt.c (boo#1212102, CVE-2023-3138)</changelog>
  <changelog author="sndirsch@suse.com" date="1695816000">- U_0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch
  U_0002-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch
  U_0003-XPutImage-clip-images-to-maximum-height-width-allowe.patch
  U_0004-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch
  U_0005-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch
  * CVE-2023-43785 libX11: out-of-bounds memory access in
    _XkbReadKeySyms() (boo#1215683)
  * CVE-2023-43786 libX11: stack exhaustion from infinite recursion
  in PutSubImage() (boo#1215684)
  * CVE-2023-43787 libX11: integer overflow in XCreateImage()
    leading to a heap overflow (boo#1215685)</changelog>
</package>
<package pkgid="3a771593fa9af56fdd580bfc56028feb71c4ef02552b68c0c89adad70d301af3" name="libapparmor" arch="src">
  <version epoch="0" ver="3.0.4" rel="150500.11.9.1"/>
  <changelog author="suse-beta@cboltz.de" date="1634299200">- add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1636459200">- add aa-notify-more-arch-mr809.diff: Add support for reading s390x
  and aarch64 wtmp files (boo#1181155)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1639915200">- add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and
  /etc/ssl/engines.d/ in abstractions/openssl which were introduced
  with the latest openssl update</changelog>
  <changelog author="nopower@suse.com" date="1640001600">-  Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED
  operation="file_mmap" violation in SLE15-SP4; (bsc#1192336).</changelog>
  <changelog author="scabrero@suse.de" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb (bsc#1192684).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1643198400">- add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221,
  MR 827)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1644494400">- update to AppArmor 3.0.4
  - various fixes in profiles, abstractions, apparmor_parser and utils
    (some of them were already included as patches)
  - add support for mctp address family
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4
    for the full upstream changelog
- remove upstream(ed) patches:
  - aa-notify-more-arch-mr809.diff
  - ruby-3.1-build-fix.diff
  - add-samba-bgqd.diff
  - openssl-engdef-mr818.diff
  - profiles-python-3.10-mr783.diff
  - update-samba-abstractions-ldb2.diff
- refresh patches:
  - apparmor-samba-include-permissions-for-shares.diff
  - ruby-2_0-mkmf-destdir.patch</changelog>
  <changelog author="nopower@suse.com" date="1648123200">- Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1648555200">- ensure precompiled cache files are newer than (text) profiles
- reload profiles in %posttrans instead of %post to ensure both
  - profiles and -abstractons package are updated before the cache
  in /var/cache/apparmor/ gets built (boo#1195463 #c20)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1649592000">- add profile for zgrep and xzgrep to prevent CVE-2022-1271
  (zgrep-profile-mr870.diff)</changelog>
  <changelog author="nopower@suse.com" date="1649678400">- Add samba_deny_net_admin.patch to add new rule to deny
  noisy setsockopt calls from systemd; (bnc#1196850).</changelog>
  <changelog author="nopower@suse.com" date="1649851200">- Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon
  which now will spawn new additional services on demand. We need to
  modify the existing smbd/winbind profiles and additionally add a
  new set of profiles to cater for the new functionality;
  (bnc#1198309);</changelog>
  <changelog author="suse-beta@cboltz.de" date="1650110400">- update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531)</changelog>
  <changelog author="dimstar@opensuse.org" date="1651060800">- Enhance zgrep-profile-mr870.diff to also allow/support zstd
  (boo#1198922).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1651233600">- add php8-fpm-mr876.patch so that php8 php-fpm can read its config
  (boo#1186267#c11)
- parser: add conflict with apparmor-utils &lt; 3.0 to avoid aa-status
  file conflict on upgrade (boo#1198958)
- utils: add missing dependency on apparmor-parser (boo#1198958#c4)</changelog>
  <changelog author="ddiss@suse.com" date="1661515200">- add profiles-permit-php-fpm-pid-files-directly-under-run.patch
  https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344)</changelog>
  <changelog author="scabrero@suse.de" date="1671796800">- Add samba-4-17.patch to update the samba profiles for samba
  version 4.17 (bsc#1206626);</changelog>
  <changelog author="ddiss@suse.com" date="1690286400">- Add pam_apparmor README, referenced from online cha-apparmor-pam.html
  documentation (bsc#1213472)</changelog>
  <changelog author="ddiss@suse.com" date="1693915200">- update zgrep profile to allow egrep helper use (bsc#1214458)
  - zgrep-profile-sync-with-master.diff</changelog>
  <changelog author="ddiss@suse.com" date="1695643200">- Fix pam_apparmor %post and %postun scripts to handle pam-config errors
  (bsc#1215596)</changelog>
</package>
<package pkgid="6c65d123e693192f3086aab19eadf00d2766a8b52abc9123418ab1c74517b71a" name="libapparmor1" arch="aarch64">
  <version epoch="0" ver="3.0.4" rel="150500.11.9.1"/>
  <changelog author="suse-beta@cboltz.de" date="1634299200">- add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1636459200">- add aa-notify-more-arch-mr809.diff: Add support for reading s390x
  and aarch64 wtmp files (boo#1181155)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1639915200">- add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and
  /etc/ssl/engines.d/ in abstractions/openssl which were introduced
  with the latest openssl update</changelog>
  <changelog author="nopower@suse.com" date="1640001600">-  Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED
  operation="file_mmap" violation in SLE15-SP4; (bsc#1192336).</changelog>
  <changelog author="scabrero@suse.de" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb (bsc#1192684).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1643198400">- add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221,
  MR 827)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1644494400">- update to AppArmor 3.0.4
  - various fixes in profiles, abstractions, apparmor_parser and utils
    (some of them were already included as patches)
  - add support for mctp address family
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4
    for the full upstream changelog
- remove upstream(ed) patches:
  - aa-notify-more-arch-mr809.diff
  - ruby-3.1-build-fix.diff
  - add-samba-bgqd.diff
  - openssl-engdef-mr818.diff
  - profiles-python-3.10-mr783.diff
  - update-samba-abstractions-ldb2.diff
- refresh patches:
  - apparmor-samba-include-permissions-for-shares.diff
  - ruby-2_0-mkmf-destdir.patch</changelog>
  <changelog author="nopower@suse.com" date="1648123200">- Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1648555200">- ensure precompiled cache files are newer than (text) profiles
- reload profiles in %posttrans instead of %post to ensure both
  - profiles and -abstractons package are updated before the cache
  in /var/cache/apparmor/ gets built (boo#1195463 #c20)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1649592000">- add profile for zgrep and xzgrep to prevent CVE-2022-1271
  (zgrep-profile-mr870.diff)</changelog>
  <changelog author="nopower@suse.com" date="1649678400">- Add samba_deny_net_admin.patch to add new rule to deny
  noisy setsockopt calls from systemd; (bnc#1196850).</changelog>
  <changelog author="nopower@suse.com" date="1649851200">- Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon
  which now will spawn new additional services on demand. We need to
  modify the existing smbd/winbind profiles and additionally add a
  new set of profiles to cater for the new functionality;
  (bnc#1198309);</changelog>
  <changelog author="suse-beta@cboltz.de" date="1650110400">- update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531)</changelog>
  <changelog author="dimstar@opensuse.org" date="1651060800">- Enhance zgrep-profile-mr870.diff to also allow/support zstd
  (boo#1198922).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1651233600">- add php8-fpm-mr876.patch so that php8 php-fpm can read its config
  (boo#1186267#c11)
- parser: add conflict with apparmor-utils &lt; 3.0 to avoid aa-status
  file conflict on upgrade (boo#1198958)
- utils: add missing dependency on apparmor-parser (boo#1198958#c4)</changelog>
  <changelog author="ddiss@suse.com" date="1661515200">- add profiles-permit-php-fpm-pid-files-directly-under-run.patch
  https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344)</changelog>
  <changelog author="scabrero@suse.de" date="1671796800">- Add samba-4-17.patch to update the samba profiles for samba
  version 4.17 (bsc#1206626);</changelog>
  <changelog author="ddiss@suse.com" date="1690286400">- Add pam_apparmor README, referenced from online cha-apparmor-pam.html
  documentation (bsc#1213472)</changelog>
  <changelog author="ddiss@suse.com" date="1693915200">- update zgrep profile to allow egrep helper use (bsc#1214458)
  - zgrep-profile-sync-with-master.diff</changelog>
  <changelog author="ddiss@suse.com" date="1695643200">- Fix pam_apparmor %post and %postun scripts to handle pam-config errors
  (bsc#1215596)</changelog>
</package>
<package pkgid="b64a8caccbd34dbf7e357ba65181e03ad93689600390b5e7fd1a3b8725dd819f" name="libapparmor1" arch="s390x">
  <version epoch="0" ver="3.0.4" rel="150500.11.9.1"/>
  <changelog author="suse-beta@cboltz.de" date="1634299200">- add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1636459200">- add aa-notify-more-arch-mr809.diff: Add support for reading s390x
  and aarch64 wtmp files (boo#1181155)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1639915200">- add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and
  /etc/ssl/engines.d/ in abstractions/openssl which were introduced
  with the latest openssl update</changelog>
  <changelog author="nopower@suse.com" date="1640001600">-  Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED
  operation="file_mmap" violation in SLE15-SP4; (bsc#1192336).</changelog>
  <changelog author="scabrero@suse.de" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb (bsc#1192684).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1643198400">- add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221,
  MR 827)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1644494400">- update to AppArmor 3.0.4
  - various fixes in profiles, abstractions, apparmor_parser and utils
    (some of them were already included as patches)
  - add support for mctp address family
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4
    for the full upstream changelog
- remove upstream(ed) patches:
  - aa-notify-more-arch-mr809.diff
  - ruby-3.1-build-fix.diff
  - add-samba-bgqd.diff
  - openssl-engdef-mr818.diff
  - profiles-python-3.10-mr783.diff
  - update-samba-abstractions-ldb2.diff
- refresh patches:
  - apparmor-samba-include-permissions-for-shares.diff
  - ruby-2_0-mkmf-destdir.patch</changelog>
  <changelog author="nopower@suse.com" date="1648123200">- Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1648555200">- ensure precompiled cache files are newer than (text) profiles
- reload profiles in %posttrans instead of %post to ensure both
  - profiles and -abstractons package are updated before the cache
  in /var/cache/apparmor/ gets built (boo#1195463 #c20)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1649592000">- add profile for zgrep and xzgrep to prevent CVE-2022-1271
  (zgrep-profile-mr870.diff)</changelog>
  <changelog author="nopower@suse.com" date="1649678400">- Add samba_deny_net_admin.patch to add new rule to deny
  noisy setsockopt calls from systemd; (bnc#1196850).</changelog>
  <changelog author="nopower@suse.com" date="1649851200">- Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon
  which now will spawn new additional services on demand. We need to
  modify the existing smbd/winbind profiles and additionally add a
  new set of profiles to cater for the new functionality;
  (bnc#1198309);</changelog>
  <changelog author="suse-beta@cboltz.de" date="1650110400">- update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531)</changelog>
  <changelog author="dimstar@opensuse.org" date="1651060800">- Enhance zgrep-profile-mr870.diff to also allow/support zstd
  (boo#1198922).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1651233600">- add php8-fpm-mr876.patch so that php8 php-fpm can read its config
  (boo#1186267#c11)
- parser: add conflict with apparmor-utils &lt; 3.0 to avoid aa-status
  file conflict on upgrade (boo#1198958)
- utils: add missing dependency on apparmor-parser (boo#1198958#c4)</changelog>
  <changelog author="ddiss@suse.com" date="1661515200">- add profiles-permit-php-fpm-pid-files-directly-under-run.patch
  https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344)</changelog>
  <changelog author="scabrero@suse.de" date="1671796800">- Add samba-4-17.patch to update the samba profiles for samba
  version 4.17 (bsc#1206626);</changelog>
  <changelog author="ddiss@suse.com" date="1690286400">- Add pam_apparmor README, referenced from online cha-apparmor-pam.html
  documentation (bsc#1213472)</changelog>
  <changelog author="ddiss@suse.com" date="1693915200">- update zgrep profile to allow egrep helper use (bsc#1214458)
  - zgrep-profile-sync-with-master.diff</changelog>
  <changelog author="ddiss@suse.com" date="1695643200">- Fix pam_apparmor %post and %postun scripts to handle pam-config errors
  (bsc#1215596)</changelog>
</package>
<package pkgid="f478d04a97776c45c51b8d4b1c742b925b25ca0c89528bda8fd7f1700ca361d9" name="libapparmor1" arch="x86_64">
  <version epoch="0" ver="3.0.4" rel="150500.11.9.1"/>
  <changelog author="suse-beta@cboltz.de" date="1634299200">- add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1636459200">- add aa-notify-more-arch-mr809.diff: Add support for reading s390x
  and aarch64 wtmp files (boo#1181155)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1639915200">- add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and
  /etc/ssl/engines.d/ in abstractions/openssl which were introduced
  with the latest openssl update</changelog>
  <changelog author="nopower@suse.com" date="1640001600">-  Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED
  operation="file_mmap" violation in SLE15-SP4; (bsc#1192336).</changelog>
  <changelog author="scabrero@suse.de" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb (bsc#1192684).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1643198400">- add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221,
  MR 827)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1644494400">- update to AppArmor 3.0.4
  - various fixes in profiles, abstractions, apparmor_parser and utils
    (some of them were already included as patches)
  - add support for mctp address family
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4
    for the full upstream changelog
- remove upstream(ed) patches:
  - aa-notify-more-arch-mr809.diff
  - ruby-3.1-build-fix.diff
  - add-samba-bgqd.diff
  - openssl-engdef-mr818.diff
  - profiles-python-3.10-mr783.diff
  - update-samba-abstractions-ldb2.diff
- refresh patches:
  - apparmor-samba-include-permissions-for-shares.diff
  - ruby-2_0-mkmf-destdir.patch</changelog>
  <changelog author="nopower@suse.com" date="1648123200">- Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1648555200">- ensure precompiled cache files are newer than (text) profiles
- reload profiles in %posttrans instead of %post to ensure both
  - profiles and -abstractons package are updated before the cache
  in /var/cache/apparmor/ gets built (boo#1195463 #c20)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1649592000">- add profile for zgrep and xzgrep to prevent CVE-2022-1271
  (zgrep-profile-mr870.diff)</changelog>
  <changelog author="nopower@suse.com" date="1649678400">- Add samba_deny_net_admin.patch to add new rule to deny
  noisy setsockopt calls from systemd; (bnc#1196850).</changelog>
  <changelog author="nopower@suse.com" date="1649851200">- Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon
  which now will spawn new additional services on demand. We need to
  modify the existing smbd/winbind profiles and additionally add a
  new set of profiles to cater for the new functionality;
  (bnc#1198309);</changelog>
  <changelog author="suse-beta@cboltz.de" date="1650110400">- update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531)</changelog>
  <changelog author="dimstar@opensuse.org" date="1651060800">- Enhance zgrep-profile-mr870.diff to also allow/support zstd
  (boo#1198922).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1651233600">- add php8-fpm-mr876.patch so that php8 php-fpm can read its config
  (boo#1186267#c11)
- parser: add conflict with apparmor-utils &lt; 3.0 to avoid aa-status
  file conflict on upgrade (boo#1198958)
- utils: add missing dependency on apparmor-parser (boo#1198958#c4)</changelog>
  <changelog author="ddiss@suse.com" date="1661515200">- add profiles-permit-php-fpm-pid-files-directly-under-run.patch
  https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344)</changelog>
  <changelog author="scabrero@suse.de" date="1671796800">- Add samba-4-17.patch to update the samba profiles for samba
  version 4.17 (bsc#1206626);</changelog>
  <changelog author="ddiss@suse.com" date="1690286400">- Add pam_apparmor README, referenced from online cha-apparmor-pam.html
  documentation (bsc#1213472)</changelog>
  <changelog author="ddiss@suse.com" date="1693915200">- update zgrep profile to allow egrep helper use (bsc#1214458)
  - zgrep-profile-sync-with-master.diff</changelog>
  <changelog author="ddiss@suse.com" date="1695643200">- Fix pam_apparmor %post and %postun scripts to handle pam-config errors
  (bsc#1215596)</changelog>
</package>
<package pkgid="8893ba61cac26dbf19cb9904f16d0a57caf5e69ff027530608ac75f3e5b1a63f" name="libcontainers-common" arch="noarch">
  <version epoch="0" ver="20230214" rel="150500.4.6.1"/>
  <changelog author="rbrown@suse.com" date="1654689600">- Add missing comma to previous change</changelog>
  <changelog author="dcermak@suse.com" date="1655208000">- Add missing Requires(post): sed, fixes boo#1200524
- Make %post compatible with dash</changelog>
  <changelog author="fvogt@suse.com" date="1655294400">- Use $() again in %post, but with a space for POSIX compliance</changelog>
  <changelog author="fcrozat@suse.com" date="1659528000">- Resync containers.conf / storage.conf with Fedora
- Create /etc/containers/registries.conf.d and
  add 000-shortnames.conf to it.</changelog>
  <changelog author="fvogt@suse.com" date="1660046400">- Fix obvious typo in containers.conf</changelog>
  <changelog author="dmueller@suse.com" date="1666699200">- set detached sigstore attachments for the SUSE controlled registries</changelog>
  <changelog author="dmueller@suse.com" date="1668081600">- postinstall script: slight cleanup, no functional change</changelog>
  <changelog author="dmueller@suse.com" date="1668686400">- add container-storage-driver.sh (bsc#1197093)</changelog>
  <changelog author="dcermak@suse.com" date="1669118400">- Update bundled common to 0.50.1
- Update bundled image to 5.23.1
- Update bundled storage to 1.44.0
- Drop bundled podman
- Bump version to 20221122
- Install container-storage-driver.sh in /etc/ on Leap &amp; SLE</changelog>
  <changelog author="dmueller@suse.com" date="1669636800">- add requires on util-linux-systemd for findmnt in profile script
- only set storage_driver env when no libpod exists
- avoid quoting issue</changelog>
  <changelog author="dcermak@suse.com" date="1670241600">- Remove registry.suse.com from search unqualified-search-registries:
  registry.suse.com responds very slowly to pagination repository listings
  (https://docs.docker.com/registry/spec/api/#pagination) and thereby causes
  every `podman search` to take over 90s. We have to remove it until this
  regression is fixed.</changelog>
  <changelog author="danish.prakash@suse.com" date="1673611200">- storage.conf: Unset 'driver' and set 'driver_priority' to
  allow podman to use 'btrfs' if available and fallback to
  'overlay' if not.
- .spec: rm %post script to set 'btrfs' as storage driver
  in storage.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1674648000">- Reverts https://build.opensuse.org/request/show/1060361
  Changes introduced to c/storage's storage.conf which adds
  a driver_priority attribute would break consumers of libcontainer-common
  as long as those packages are vendoring an older c/storage version.
  Instead of patching every consumer, we're reverting this change, until
  those packages have been updated downstream. [boo#1207509]</changelog>
  <changelog author="dcermak@suse.com" date="1676376000">- New upstream release 20230214
- bump c/storage to 1.45.3
- bump c/image to 5.24.1
- bump c/common to 0.51.0
- containers.conf:
  * add commented out options containers.read_only,
    engine.platform_to_oci_runtime, engine.events_container_create_inspect_data,
    network.volume_plugin_timeout, engine.runtimes.youki, machine.provider
  * remove deprecated setting containers.userns_size
  * add youki to engine.runtime_supports_json
- shortnames.conf: pull in latest upstream version
- storage.conf: add commented out option storage.transient_store
- correct license to APACHE-2.0 only (there's no GPLv3 code to be found)
- add source URLs to spec
- drop pointless copyright year</changelog>
  <changelog author="dcermak@suse.com" date="1677499200">- Add registry.suse.com to the unqualified-search-registries</changelog>
  <changelog author="dcermak@suse.com" date="1678881600">- Remove obsolete Requires(post): util-linux-systemd</changelog>
  <changelog author="dcermak@suse.com" date="1678881601">- Remove container-storage-driver.sh, we want to default to the overlay driver
  instead of btrfs.
  The btrfs driver is not really supported upstream (see
  e.g. https://github.com/containers/podman/issues/16882), there is no real
  development anymore and it appears to have subtle bugs (e.g. the one linked
  previously).
  To prevent further such issues, we will from now on default to the overlay
  driver.</changelog>
  <changelog author="fcrozat@suse.com" date="1682510400">- Own /etc/containers/systemd and /usr/share/containers/systemd,
  useful for podman quadlet.</changelog>
  <changelog author="danish.prakash@suse.com" date="1684238400">- Introduce new subpackage that adds SLE-specific mounts only
  on SLE systems (if sles-release) hence avoiding superfluous
  warnings on non-SLE systems while running podman commands.
  (bsc#1211124)</changelog>
  <changelog author="danish.prakash@suse.com" date="1694692800">- Require libcontainers-sles-mounts for *all* SLE products,
  and not just SLES. (bsc#1215291)</changelog>
</package>
<package pkgid="07169665905431ea879b032b5f85c1093a938d270154684030c210e3826d2183" name="libcontainers-common" arch="src">
  <version epoch="0" ver="20230214" rel="150500.4.6.1"/>
  <changelog author="rbrown@suse.com" date="1654689600">- Add missing comma to previous change</changelog>
  <changelog author="dcermak@suse.com" date="1655208000">- Add missing Requires(post): sed, fixes boo#1200524
- Make %post compatible with dash</changelog>
  <changelog author="fvogt@suse.com" date="1655294400">- Use $() again in %post, but with a space for POSIX compliance</changelog>
  <changelog author="fcrozat@suse.com" date="1659528000">- Resync containers.conf / storage.conf with Fedora
- Create /etc/containers/registries.conf.d and
  add 000-shortnames.conf to it.</changelog>
  <changelog author="fvogt@suse.com" date="1660046400">- Fix obvious typo in containers.conf</changelog>
  <changelog author="dmueller@suse.com" date="1666699200">- set detached sigstore attachments for the SUSE controlled registries</changelog>
  <changelog author="dmueller@suse.com" date="1668081600">- postinstall script: slight cleanup, no functional change</changelog>
  <changelog author="dmueller@suse.com" date="1668686400">- add container-storage-driver.sh (bsc#1197093)</changelog>
  <changelog author="dcermak@suse.com" date="1669118400">- Update bundled common to 0.50.1
- Update bundled image to 5.23.1
- Update bundled storage to 1.44.0
- Drop bundled podman
- Bump version to 20221122
- Install container-storage-driver.sh in /etc/ on Leap &amp; SLE</changelog>
  <changelog author="dmueller@suse.com" date="1669636800">- add requires on util-linux-systemd for findmnt in profile script
- only set storage_driver env when no libpod exists
- avoid quoting issue</changelog>
  <changelog author="dcermak@suse.com" date="1670241600">- Remove registry.suse.com from search unqualified-search-registries:
  registry.suse.com responds very slowly to pagination repository listings
  (https://docs.docker.com/registry/spec/api/#pagination) and thereby causes
  every `podman search` to take over 90s. We have to remove it until this
  regression is fixed.</changelog>
  <changelog author="danish.prakash@suse.com" date="1673611200">- storage.conf: Unset 'driver' and set 'driver_priority' to
  allow podman to use 'btrfs' if available and fallback to
  'overlay' if not.
- .spec: rm %post script to set 'btrfs' as storage driver
  in storage.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1674648000">- Reverts https://build.opensuse.org/request/show/1060361
  Changes introduced to c/storage's storage.conf which adds
  a driver_priority attribute would break consumers of libcontainer-common
  as long as those packages are vendoring an older c/storage version.
  Instead of patching every consumer, we're reverting this change, until
  those packages have been updated downstream. [boo#1207509]</changelog>
  <changelog author="dcermak@suse.com" date="1676376000">- New upstream release 20230214
- bump c/storage to 1.45.3
- bump c/image to 5.24.1
- bump c/common to 0.51.0
- containers.conf:
  * add commented out options containers.read_only,
    engine.platform_to_oci_runtime, engine.events_container_create_inspect_data,
    network.volume_plugin_timeout, engine.runtimes.youki, machine.provider
  * remove deprecated setting containers.userns_size
  * add youki to engine.runtime_supports_json
- shortnames.conf: pull in latest upstream version
- storage.conf: add commented out option storage.transient_store
- correct license to APACHE-2.0 only (there's no GPLv3 code to be found)
- add source URLs to spec
- drop pointless copyright year</changelog>
  <changelog author="dcermak@suse.com" date="1677499200">- Add registry.suse.com to the unqualified-search-registries</changelog>
  <changelog author="dcermak@suse.com" date="1678881600">- Remove obsolete Requires(post): util-linux-systemd</changelog>
  <changelog author="dcermak@suse.com" date="1678881601">- Remove container-storage-driver.sh, we want to default to the overlay driver
  instead of btrfs.
  The btrfs driver is not really supported upstream (see
  e.g. https://github.com/containers/podman/issues/16882), there is no real
  development anymore and it appears to have subtle bugs (e.g. the one linked
  previously).
  To prevent further such issues, we will from now on default to the overlay
  driver.</changelog>
  <changelog author="fcrozat@suse.com" date="1682510400">- Own /etc/containers/systemd and /usr/share/containers/systemd,
  useful for podman quadlet.</changelog>
  <changelog author="danish.prakash@suse.com" date="1684238400">- Introduce new subpackage that adds SLE-specific mounts only
  on SLE systems (if sles-release) hence avoiding superfluous
  warnings on non-SLE systems while running podman commands.
  (bsc#1211124)</changelog>
  <changelog author="danish.prakash@suse.com" date="1694692800">- Require libcontainers-sles-mounts for *all* SLE products,
  and not just SLES. (bsc#1215291)</changelog>
</package>
<package pkgid="5e53e6af00f2b89a2c4ab85cf05693ed4d7a3a5f748087e0e09f834697637f69" name="libcontainers-sles-mounts" arch="noarch">
  <version epoch="0" ver="20230214" rel="150500.4.6.1"/>
  <changelog author="rbrown@suse.com" date="1654689600">- Add missing comma to previous change</changelog>
  <changelog author="dcermak@suse.com" date="1655208000">- Add missing Requires(post): sed, fixes boo#1200524
- Make %post compatible with dash</changelog>
  <changelog author="fvogt@suse.com" date="1655294400">- Use $() again in %post, but with a space for POSIX compliance</changelog>
  <changelog author="fcrozat@suse.com" date="1659528000">- Resync containers.conf / storage.conf with Fedora
- Create /etc/containers/registries.conf.d and
  add 000-shortnames.conf to it.</changelog>
  <changelog author="fvogt@suse.com" date="1660046400">- Fix obvious typo in containers.conf</changelog>
  <changelog author="dmueller@suse.com" date="1666699200">- set detached sigstore attachments for the SUSE controlled registries</changelog>
  <changelog author="dmueller@suse.com" date="1668081600">- postinstall script: slight cleanup, no functional change</changelog>
  <changelog author="dmueller@suse.com" date="1668686400">- add container-storage-driver.sh (bsc#1197093)</changelog>
  <changelog author="dcermak@suse.com" date="1669118400">- Update bundled common to 0.50.1
- Update bundled image to 5.23.1
- Update bundled storage to 1.44.0
- Drop bundled podman
- Bump version to 20221122
- Install container-storage-driver.sh in /etc/ on Leap &amp; SLE</changelog>
  <changelog author="dmueller@suse.com" date="1669636800">- add requires on util-linux-systemd for findmnt in profile script
- only set storage_driver env when no libpod exists
- avoid quoting issue</changelog>
  <changelog author="dcermak@suse.com" date="1670241600">- Remove registry.suse.com from search unqualified-search-registries:
  registry.suse.com responds very slowly to pagination repository listings
  (https://docs.docker.com/registry/spec/api/#pagination) and thereby causes
  every `podman search` to take over 90s. We have to remove it until this
  regression is fixed.</changelog>
  <changelog author="danish.prakash@suse.com" date="1673611200">- storage.conf: Unset 'driver' and set 'driver_priority' to
  allow podman to use 'btrfs' if available and fallback to
  'overlay' if not.
- .spec: rm %post script to set 'btrfs' as storage driver
  in storage.conf</changelog>
  <changelog author="danish.prakash@suse.com" date="1674648000">- Reverts https://build.opensuse.org/request/show/1060361
  Changes introduced to c/storage's storage.conf which adds
  a driver_priority attribute would break consumers of libcontainer-common
  as long as those packages are vendoring an older c/storage version.
  Instead of patching every consumer, we're reverting this change, until
  those packages have been updated downstream. [boo#1207509]</changelog>
  <changelog author="dcermak@suse.com" date="1676376000">- New upstream release 20230214
- bump c/storage to 1.45.3
- bump c/image to 5.24.1
- bump c/common to 0.51.0
- containers.conf:
  * add commented out options containers.read_only,
    engine.platform_to_oci_runtime, engine.events_container_create_inspect_data,
    network.volume_plugin_timeout, engine.runtimes.youki, machine.provider
  * remove deprecated setting containers.userns_size
  * add youki to engine.runtime_supports_json
- shortnames.conf: pull in latest upstream version
- storage.conf: add commented out option storage.transient_store
- correct license to APACHE-2.0 only (there's no GPLv3 code to be found)
- add source URLs to spec
- drop pointless copyright year</changelog>
  <changelog author="dcermak@suse.com" date="1677499200">- Add registry.suse.com to the unqualified-search-registries</changelog>
  <changelog author="dcermak@suse.com" date="1678881600">- Remove obsolete Requires(post): util-linux-systemd</changelog>
  <changelog author="dcermak@suse.com" date="1678881601">- Remove container-storage-driver.sh, we want to default to the overlay driver
  instead of btrfs.
  The btrfs driver is not really supported upstream (see
  e.g. https://github.com/containers/podman/issues/16882), there is no real
  development anymore and it appears to have subtle bugs (e.g. the one linked
  previously).
  To prevent further such issues, we will from now on default to the overlay
  driver.</changelog>
  <changelog author="fcrozat@suse.com" date="1682510400">- Own /etc/containers/systemd and /usr/share/containers/systemd,
  useful for podman quadlet.</changelog>
  <changelog author="danish.prakash@suse.com" date="1684238400">- Introduce new subpackage that adds SLE-specific mounts only
  on SLE systems (if sles-release) hence avoiding superfluous
  warnings on non-SLE systems while running podman commands.
  (bsc#1211124)</changelog>
  <changelog author="danish.prakash@suse.com" date="1694692800">- Require libcontainers-sles-mounts for *all* SLE products,
  and not just SLES. (bsc#1215291)</changelog>
</package>
<package pkgid="cabf433a58c2f8b915542fe52c89e140d5fc92937f5d9d68ef504599087cd101" name="libcups2" arch="aarch64">
  <version epoch="0" ver="2.2.7" rel="150000.3.51.2"/>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
</package>
<package pkgid="2cc39b42ba89bf48cfe4f5cc3677e4adc812112e6a5f4dbc430cf381fafa09c0" name="libcups2" arch="s390x">
  <version epoch="0" ver="2.2.7" rel="150000.3.51.2"/>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
</package>
<package pkgid="1a68aff3becd9341eb7bfe420f5e548336542ae3d94616edf9fe9052b5dad535" name="libcups2" arch="x86_64">
  <version epoch="0" ver="2.2.7" rel="150000.3.51.2"/>
  <changelog author="jsmeix@suse.de" date="1510056000">- Version upgrade to 2.2.6:
  CUPS 2.2.6 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  Changes include:
  * DBUS notifications could crash the scheduler (Issue #5143)
    (see also bsc#1061066 "DBUS library aborts caller process")</changelog>
  <changelog author="christophe@krop.fr" date="1510660800">- Make sure cups-libs-&lt;targettype&gt; is removed</changelog>
  <changelog author="jsmeix@suse.de" date="1522238400">- Version upgrade to 2.2.7:
  CUPS 2.2.7 is a general bug fix release.
  For details see https://github.com/apple/cups/releases
  or the CHANGES.md file.
  Changes include:
  * Additional security fixes for:
    bsc#1061066 DBUS library aborts caller process
    in _dbus_check_is_valid_utf8 (in particular that aborts cupsd)
    and
    bsc#1087018 CVE-2017-18248: cups: The add_job function in
    scheduler/ipp.c in CUPS before 2.2.6, when D-Bus support is
    enabled, can be crashed by remote attackers by sending print
    jobs with an invalid username, related to a D-Bus notification
    which are the CUPS upstream issues
    https://github.com/apple/cups/issues/5143
    Remote DoS attack against cupsd via invalid username
    and malicious D-Bus library
    and
    https://github.com/apple/cups/issues/5186
    squash non-UTF-8 strings into ASCII on plain IPP level
    and
    https://github.com/apple/cups/issues/5229
    persistently substitute invalid job attributes
    with default values - not only in add_job
    see also
    bsc#1087072 dbus-1:
    Disable assertions to prevent un-expected DDoS attacks
  * NOTICE: Raw print queues are now deprecated (Issue #5269)
    so that now there is a warning message when you
    add or modify a queue to use the "raw driver" but
    raw printing will continue to work through CUPS 2.3.x, cf.
    https://lists.cups.org/pipermail/cups/2018-March/074060.html
  * Fixed an Avahi crash bug in the scheduler (Issue #5268)
  * Systemd did not restart cupsd when configuration changes
    were made that required a restart (Issue #5263)
  * The scheduler could crash while adding an IPP Everywhere
    printer (Issue #5258)
  * The scheduler now supports using temporary print queues
    for older IPP/1.1 print queues like those shared by CUPS 1.3
    and earlier (Issue #5241)
  * Kerberized printing to another CUPS server did not work
    correctly (Issue #5233)
  * More fixes for printing to old CUPS servers (Issue #5211)
  * The scheduler now substitutes default values for invalid
    job attributes when running in "relaxed conformance"
    mode (Issue #5186)
  * The cups-driverd program incorrectly stopped scanning PPDs
    as soon as a loop was seen (Issue #5170)
  * The `SSLOptions` directive now supports `MinTLS` and `MaxTLS`
    options to control the minimum and maximum TLS versions
    that will be allowed, respectively (Issue #5119)
  * The scheduler did not write out dirty configuration and
    state files if there were open client connections (Issue #5118)
  * The `lpadmin` command now provides a better error message when
    an unsupported System V interface script is used (Issue #5111)
  * No longer support backslash, question mark, or quotes
    in printer names (Issue #4966)
  * The CUPS library now supports the latest HTTP Digest
    authentication specification including support
    for SHA-256 (Issue #4862)
  * TLS connections now properly timeout (rdar://34938533)</changelog>
  <changelog author="jsmeix@suse.de" date="1529323200">- cups-branch-2.2-commit-97cb566568a8c3a9c07c7ccec09f28f5c5015954.diff
  is 'git show 97cb566568a8c3a9c07c7ccec09f28f5c5015954' for
  https://github.com/apple/cups/commit/97cb566568a8c3a9c07c7ccec09f28f5c5015954
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes local privilege escalation to root and sandbox
  bypasses in scheduler (Apple's internal issues rdar://37836779,
  rdar://37836995, rdar://37837252, rdar://37837581)
  in the CUPS 2.2 branch
  bsc#1096405 CVE-2018-4180:
  Local Privilege Escalation to Root in dnssd Backend (CUPS_SERVERBIN)
  bsc#1096406 CVE-2018-4181:
  Limited Local File Reads as Root via cupsd.conf Include Directive
  bsc#1096407 CVE-2018-4182:
  cups-exec Sandbox Bypass Due to Insecure Error Handling
  bsc#1096408 CVE-2018-4183:
  cups-exec Sandbox Bypass Due to Profile Misconfiguration</changelog>
  <changelog author="jsmeix@suse.de" date="1543838400">- cups-2.2.7-CVE-2018-4700.patch fixes CVE-2018-4700: session
  cookie is extremely predictable, effectively breaking the
  CSRF protection of the CUPS web interface (bsc#1115750)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1550750400">- Add issue5509-fix-utf-8-validation-issue.patch (bsc#1118118)
  Fixes https://github.com/apple/cups/issues/5509</changelog>
  <changelog author="jsmeix@suse.de" date="1573646400">- cups-2.2.7-CVE-2019-8675.CVE-2019-8696.patch fixes
  CVE-2019-8675 and CVE-2019-8696 (bsc#1146358 and bsc#1146359)
  and some other security/disclosure issues
  https://github.com/apple/cups/commit/f24e6cf6a39300ad0c3726a41a4aab51ad54c109
  (Apple's internal issues rdar://51685251, rdar://50035411,
  rdar://51373853, rdar://51373929)</changelog>
  <changelog author="jsmeix@suse.de" date="1586174400">- cups-2.2.7-CVE-2020-3898.patch fixes CVE-2020-3898 (bsc#1168422)
  heap-buffer-overflow in libcups ppdFindOption() function</changelog>
  <changelog author="jsmeix@suse.de" date="1610366400">- cups-2.2.7-CVE-2020-10001.patch fixes CVE-2020-10001
  access to uninitialized buffer in ipp.c (bsc#1180520)
- cups-2.2.7-CVE-2019-8842.patch fixes CVE-2019-8842 (bsc#1170671)
  the ippReadIO function may under-read an extension field</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- cups-2.2.7-web-ui-kerberos-authentication.patch (bsc#1175960)
  Fix web UI kerberos authentication</changelog>
  <changelog author="jsmeix@suse.de" date="1618228800">- When cupsd creates directories with specific owner group
  and permissions (usually owner is 'root' and group matches
  "configure --with-cups-group=lp") specify same owner group and
  permissions in the RPM spec file to ensure those directories
  are installed by RPM with the right settings because if those
  directories were installed by RPM with different settings then
  cupsd would use them as is and not adjust its specific owner
  group and permissions which could lead to privilege escalation
  from 'lp' user to 'root' via symlink attacks e.g. if owner is
  falsely 'lp' instead of 'root' CVE-2021-25317 (bsc#1184161)</changelog>
  <changelog author="jsmeix@suse.de" date="1649160000">- SUSE_bsc_1189517.patch is
  https://github.com/apple/cups/commit/821b3cc956d46b811facd50986acc9f24f0e1c79
  which belongs to https://github.com/apple/cups/issues/5288
  that fixes bsc#1189517
  "cups printservice takes much longer than before
  with a big number of printers"
  see in particular
  https://github.com/apple/cups/issues/5288#issuecomment-921626381
- SUSE_bsc_1195115.patch is
  https://github.com/apple/cups/commit/ba9d68cc7467a7a47ef219071902b9e9eb6dbc44
  which belongs to https://github.com/apple/cups/issues/5538
  that fixes bsc#1195115
  "CUPS PreserveJobHistory doesn't work with seconds"</changelog>
  <changelog author="jsmeix@suse.de" date="1653048000">- cups-2.2.7-CVE-2022-26691.patch fixes CVE-2022-26691
  cups: authentication bypass and code execution (bsc#1199474)</changelog>
  <changelog author="vliaskovitis@suse.com" date="1659700800">- cups-branch-2.2-commit-3e4dd41459dabc5d18edbe06eb5b81291885204b.diff
  is 'git show 3e4dd41459dabc5d18edbe06eb5b81291885204b' for
  https://github.com/apple/cups/commit/3e4dd41459dabc5d18edbe06eb5b81291885204b
  (except the not needed hunk for patching CHANGES.md which fails)
  that fixes handling of MaxJobTime 0 (Issue #5438) in the CUPS 2.2 branch
  bsc#1201511:
  Stuck print jobs being cancelled immediately, despite MaxJobTime being set to 0</changelog>
  <changelog author="vliaskovitis@suse.com" date="1677758400">- cups-branch-2.2-commit-876fdc1c90a885a58644c8757bc1283c9fd5bcb7.diff
  is https://github.com/OpenPrinting/cups/commit/876fdc1c90a885a58644c8757bc1283c9fd5bcb7
  which belongs to https://github.com/OpenPrinting/cups/issues/308
  that fixes bsc#1191525, bsc#1203446:
  "Print jobs on cups.sock return with EAGAIN (Resource temporarily unavailable)"
  "/usr/bin/lpr: Error - The printer or class does not exist."</changelog>
  <changelog author="jsmeix@suse.com" date="1678363200">- 0001-cups-dests.c-cupsGetNamedDest-set-IPP_STATUS_ERROR_N.patch
  improves logging on 'IPP_STATUS_ERROR_NOT_FOUND' error
  that fixes bsc#1191467, bsc#1198932:
  "lpr reports 'No such file or directory' for missing catalogue files"
  "/usr/bin/lpr: No such file or directory"
- after-network_target-sssd_service.patch
  is derived from https://github.com/apple/cups/issues/5550 with its
  https://github.com/apple/cups/commit/aaebca5660fdd7f7b6f30461f0788d91ef6e2fee
  and SUSE PTF:24471 cups.SUSE_SLE-15_Update cups-2.2.7-wait-for-network.patch
  to add "After=network.target sssd.service" to the systemd unit
  source files cupsd.service.in and cups.cups-lpdAT.service.in
  to fix bsc#1201234, bsc#1200321:
  "Missing network dependency in systemd unit for cups-2.2.7"
  "CUPS may not always start if sssd is in use"</changelog>
  <changelog author="jsmeix@suse.com" date="1684929600">- cups-2.2.7-CVE-2023-32324.patch fixes CVE-2023-32324
  "Heap buffer overflow in cupsd"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-cxc6-w2g7-69p7
  bsc#1211643</changelog>
  <changelog author="jsmeix@suse.com" date="1686571200">- cups-2.2.7-CVE-2023-34241.patch fixes CVE-2023-34241
  "use-after-free in cupsdAcceptClient()"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
  bsc#1212230</changelog>
  <changelog author="jsmeix@suse.com" date="1694001600">- cups-2.2.7-CVE-2023-32360.patch fixes CVE-2023-32360
  "Information leak through Cups-Get-Document operation"
  by requiring authentication for CUPS-Get-Document in cupsd.conf
  https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
  bsc#1214254
- cups-2.2.7-additional_policies.patch is an updated version
  of cups-2.0.3-additional_policies.patch that replaces it
  to add the 'allowallforanybody' policy to cupsd.conf
  after cups-2.2.7-CVE-2023-32360.patch was applied</changelog>
  <changelog author="jsmeix@suse.com" date="1694520000">- cups-2.2.7-CVE-2023-4504.patch fixes CVE-2023-4504
  "CUPS PostScript Parsing Heap Overflow"
  https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
  bsc#1215204</changelog>
</package>
<package pkgid="c0b0b5e64bc9555dfc00f4a6459deb6e5f7e0585f05ce39aba551ce6b7827152" name="libcurl4" arch="aarch64">
  <version epoch="0" ver="8.0.1" rel="150400.5.32.1"/>
  <changelog author="pmonreal@suse.com" date="1664539200">- Change the deprecated configure option --enable-hidden-symbols
  to the new --enable-symbol-hiding.</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665230400">- Update connection info when using UNIX socket as endpoint
  connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666785600">- Update to 7.86.0:
  * Security fixes:
  - POST following PUT confusion [bsc#1204383, CVE-2022-32221]
  - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260]
  - HTTP proxy double-free [bsc#1204385, CVE-2022-42915]
  - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916]
  * Changes:
  - NPN: remove support for and use of
  - Websockets: initial support
  * Bugfixes:
  - altsvc: reject bad port numbers
  - autotools: reduce brute-force when detecting recv/send arg list
  - aws_sigv4: fix header computation
  - cli tool: do not use disabled protocols
  - connect: change verbose IPv6 address:port to [address]:port
  - connect: fix builds without AF_INET6
  - connect: fix Curl_updateconninfo for TRNSPRT_UNIX
  - connect: fix the wrong error message on connect failures
  - content_encoding: use writer struct subclasses for different encodings
  - cookie: reject cookie names or content with TAB characters
  - curl/add_file_name_to_url: use the libcurl URL parser
  - curl/get_url_file_name: use libcurl URL parser
  - curl: warn for --ssl use, considered insecure
  - docs/libcurl/symbols-in-versions: add several missing symbols
  - ftp: ignore a 550 response to MDTM
  - functypes: provide the recv and send arg and return types
  - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled
  - header: define public API functions as extern c
  - headers: reset the requests counter at transfer start
  - hostip: guard PF_INET6 use
  - hostip: lazily wait to figure out if IPv6 works until needed
  - http, vauth: always provide Curl_allow_auth_to_host() functionality
  - http2: make nghttp2 less picky about field whitespace
  - http: try parsing Retry-After: as a number first
  - http_proxy: restore the protocol pointer on error
  - lib: add missing limits.h includes
  - lib: prepare the incoming of additional protocols
  - lib: sanitize conditional exclusion around MIME
  - libssh: if sftp_init fails, don't get the sftp error code
  - mprintf: reject two kinds of precision for the same argument
  - mqtt: return error for too long topic
  - netrc: compare user name case sensitively
  - netrc: replace fgets with Curl_get_line
  - netrc: use the URL-decoded user
  - ngtcp2: fix build errors due to changes in ngtcp2 library
  - noproxy: support proxies specified using cidr notation
  - openssl: make certinfo available for QUIC
  - resolve: make forced IPv4 resolve only use A queries
  - schannel: ban server ALPN change during recv renegotiation
  - schannel: don't reset recv/send function pointers on renegotiation
  - schannel: when importing PFX, disable key persistence
  - setopt: use the handler table for protocol name to number conversions
  - setopt: when POST is set, reset the 'upload' field
  - single_transfer: use the libcurl URL parser when appending query parts
  - smb: replace CURL_WIN32 with WIN32
  - tool: avoid generating ambiguous escaped characters in --libcurl
  - tool_main: exit at once if out of file descriptors
  - tool_operate: more transfer cleanup after parallel transfer fail
  - tool_operate: prevent over-queuing in parallel mode
  - tool_paramhelp: asserts verify maximum sizes for string loading
  - tool_xattr: save the original URL, not the final redirected one
  - url: a zero-length userinfo part in the URL is still a (blank) user
  - url: allow non-HTTPS HSTS-matching for debug builds
  - url: rename function due to name-clash in Watt-32
  - url: use IDN decoded names for HSTS checks
  - urlapi: detect scheme better when not guessing
  - urlapi: fix parsing URL without slash with CURLU_URLENCODE
  - urlapi: reject more bad characters from the host name field
  * Remove patch upstream:
  - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch</changelog>
  <changelog author="luc14n0@opensuse.org" date="1668600000">- Add 1.50.0 as the minimum libnghttp2 build requirement version as
  a bandaid. Curl's 7.86.0 release introduces the use of
  nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation,
  introduced by nghttp2 1.50.0 release, without introducing a check
  for the function/right version in their build scripts. This will
  make Zypper/cURL unusable in some corner cases where users
  installing something that requires libcurl4 before doing full
  system upgrade, thus updating the cURL stack, but not
  libnghttp2's. Background: boo#1204983, Factory mailing list
  threadd:
  "? broken dependency in curl and/or *zyp* ?", and forums thread:
  Curl-is-broken-after-an-update-which-subsequently-breaks-zypper.</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
  <changelog author="david.anes@suse.com" date="1671624000">- Update to 7.87.0:
  * Security fixes:
  - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN
  - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free
  * Changes
  - curl: add --url-query
  - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit
  - lib: add CURL_WRITEFUNC_ERROR to signal write callback error
  - openssl: reduce CA certificate bundle reparsing by caching
  - version: add a feature names array to curl_version_info_data
  * Bugfixes
  - altsvc: fix rejection of negative port numbers
  - aws_sigv4: consult x-%s-content-sha256 for payload hash
  - aws_sigv4: fix typos in aws_sigv4.c
  - base64: better alloc size
  - base64: encode without using snprintf
  - base64: faster base64 decoding
  - build: assume assert.h is always available
  - build: assume errno.h is always available
  - c-hyper: CONNECT respones are not server responses
  - c-hyper: fix multi-request mechanism
  - CI: Change FreeBSD image from 12.3 to 12.4
  - CI: LGTM.com will be shut down in December 2022
  - ci: Remove zuul fuzzing job as it's superseded by CIFuzz
  - cmake: check for cross-compile, not for toolchain
  - CMake: fix build with `CURL_USE_GSSAPI`
  - cmake: really enable warnings with clang
  - cmake: set the soname on the shared library
  - cmdline-opts/gen.pl: fix the linkifier
  - cmdline-opts/page-footer: remove long option nroff formatting
  - config-mac: define HAVE_SYS_IOCTL_H
  - config-mac: fix typo: size_T -&gt; size_t
  - config-mac: remove HAVE_SYS_SELECT_H
  - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW
  - configure: require fork for NTLM-WB
  - contributors.sh: actually use $CURLWWW instead of just setting it
  - cookie: compare cookie prefixes case insensitively
  - cookie: expire cookies at once when max-age is negative
  - cookie: open cookie jar as a binary file
  - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS
  - curl-rustls.m4: on macOS, rustls also needs the Security framework
  - curl.h: include &lt;sys/select.h&gt; on SerenityOS
  - curl.h: name all public function parameters
  - curl.h: reword comment to not use deprecated option
  - curl: override the numeric locale and set "C" by force
  - curl: timeout in the read callback
  - curl_endian: remove Curl_write64_le from header
  - curl_get_line: allow last line without newline char
  - curl_path: do not add '/' if homedir ends with one
  - curl_url_get.3: remove spurious backtick
  - curl_url_set.3: document CURLU_DISALLOW_USER
  - curl_url_set.3: fix typo
  - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE
  - CURLOPT_COOKIEFILE.3: advice =&gt; advise
  - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example
  - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw"
  - CURLOPT_POST.3: Explain setting to 0 changes request type
  - docs/curl_ws_send: Fixed typo in websocket docs
  - docs/EARLY-RELEASE.md: how to determine an early release
  - docs/examples: spell correction ('Retrieve')
  - docs/INSTALL.md: expand on static builds
  - docs/WEBSOCKET.md: explain the URL use
  - docs: add missing parameters for --retry flag
  - docs: add more "SEE ALSO" links to CA related pages
  - docs: explain the noproxy CIDR notation support
  - docs: extend the dump-header documentation
  - docs: remove performance note in CURLOPT_SSL_VERIFYPEER
  - examples/10-at-a-time: fix possible skipped final transfers
  - examples: update descriptions
  - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH
  - gen.pl: do not generate CURLHELP bitmask lines &gt; 79 characters
  - GHA: clarify workflows permissions, set least possible privilege
  - GHA: NSS use clang instead of clang-9
  - gnutls: use common gnutls init and verify code for ngtcp2
  - headers: add endif comments
  - HTTP-COOKIES.md: mention that http://localhost is a secure context
  - HTTP-COOKIES.md: update the 6265bis link to draft-11
  - http: do not send PROXY more than once
  - http: fix the ::1 comparison for IPv6 localhost for cookies
  - http: set 'this_is_a_follow' in the Location: logic
  - http: use the IDN decoded name in HSTS checks
  - hyper: classify headers as CONNECT and 1XX
  - hyper: fix handling of hyper_task's when reusing the same address
  - idn: remove Curl_win32_ascii_to_idn
  - INSTALL: update operating systems and CPU archs
  - KNOWN_BUGS: remove eight entries
  - lib1560: add some basic IDN host name tests
  - lib: connection filters (cfilter) addition to curl:
  - lib: feature deprecation warnings in gcc &gt;= 4.3
  - lib: fix some type mismatches and remove unneeded typecasts
  - lib: parse numbers with fixed known base 10
  - lib: remove bad set.opt_no_body assignments
  - lib: rewind BEFORE request instead of AFTER previous
  - lib: sync guard for Curl_getaddrinfo_ex() definition and use
  - lib: use size_t or int etc instead of longs
  - libcurl-errors.3: remove duplicate word
  - libssh2: return error when ssh_hostkeyfunc returns error
  - limit-rate.d: see also --rate
  - log2changes.pl: wrap long lines at 80 columns
  - Makefile.mk: address minor issues
  - Makefile.mk: improve a GNU Make hack
  - Makefile.mk: portable Makefile.m32
  - maketgz: set the right version in lib/libcurl.plist
  - mime: relax easy/mime structures binding
  - misc: Fix incorrect spelling
  - misc: remove duplicated include files
  - misc: typo and grammar fixes
  - negtelnetserver.py: have it call its close() method
  - netrc.d: provide mutext info
  - netware: remove leftover traces
  - noproxy: also match with adjacent comma
  - noproxy: guard against empty hostnames in noproxy check
  - noproxy: tailmatch like in 7.85.0 and earlier
  - nroff-scan.pl: detect double highlights
  - ntlm: improve comment for encrypt_des
  - ntlm: silence ubsan warning about copying from null target_info pointer
  - openssl/mbedtls: use %d for outputing port with failf (int)
  - openssl: prefix errors with '[lib]/[version]: '
  - os400: use platform socklen_t in Curl_getnameinfo_a
  - page-header: grammar improvement (display transfer rate)
  - proxy: refactor haproxy protocol handling as connection filter
  - README.md: remove badges and xmas-tree garnish
  - rtsp: fix RTSP auth
  - runtests: --no-debuginfod now disables DEBUGINFOD_URLS
  - runtests: do CRLF replacements per section only
  - scripts/checksrc.pl: detect duplicated include files
  - sendf: change Curl_read_plain to wrap Curl_recv_plain
  - sendf: remove unnecessary if condition
  - setup: do not require __MRC__ defined for Mac OS 9 builds
  - smb/telnet: do not free the protocol struct in *_done()
  - socks: fix username max size is 255 (0xFF)
  - spellcheck.words: remove 'github' as an accepted word
  - ssl-reqd.d: clarify that this is for upgrading connections only
  - strcase: use curl_str(n)equal for case insensitive matches
  - styled-output.d: this option does not work on Windows
  - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS
  - system.h: support 64-bit curl_off_t for NonStop 32-bit
  - test1421: fix typo
  - test3026: reduce runtime in legacy mingw builds
  - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+
  - tests: add authorityInfoAccess to generated certs
  - tests: add HTTP/3 test case, custom location for proper nghttpx
  - tls: backends use connection filters for IO, enabling HTTPS-proxy
  - tool: determine the correct fopen option for -D
  - tool_cfgable: free the ssl_ec_curves on exit
  - tool_cfgable: make socks5_gssapi_nec a boolean
  - tool_formparse: avoid clobbering on function params
  - tool_getparam: make --no-get work as the opposite of --get
  - tool_operate: provide better errmsg for -G with bad URL
  - tool_operate: when aborting, make sure there is a non-NULL error buffer
  - tool_paramhlp: free the proto strings on exit
  - url: move back the IDN conversion of proxy names
  - urlapi: reject more bad letters from the host name: &amp;+()
  - urldata: change port num storage to int and unsigned short
  - vms: remove SIZEOF_SHORT
  - vtls: fix build without proxy support
  - vtls: localization of state data in filters
  - WEBSOCKET.md: fix broken link
  - Websocket: fixes for partial frames and buffer updates
  - websockets: fix handling of partial frames
  - windows: fail early with a missing windres in autotools
  - windows: fix linking .rc to shared curl with autotools
  - winidn: drop WANT_IDN_PROTOTYPES
  - ws: if no connection is around, return error
  - ws: return CURLE_NOT_BUILT_IN when websockets not built in
  - x509asn1: avoid freeing unallocated pointers</changelog>
  <changelog author="pmonreal@suse.com" date="1675771200">- Security Fixes:
  * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914]
  * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915]
  * Add curl-CVE-2023-23914-23915.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771201">- Security Fix: [bsc#1207992, CVE-2023-23916]
  * HTTP multi-header compression denial of service
  * Add curl-CVE-2023-23916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1676462400">- Update to 7.88.0: [bsc#1207990, CVE-2023-23914]
  [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916]
  * Security fixes:
  - CVE-2023-23914: HSTS ignored on multiple requests
  - CVE-2023-23915: HSTS amnesia with --parallel
  - CVE-2023-23916: HTTP multi-header compression denial of service
  * Changes:
  - curl.h: add CURL_HTTP_VERSION_3ONLY
  - share: add sharing of HSTS cache among handles
  - src: add --http3-only
  - tool_operate: share HSTS between handles
  - urlapi: add CURLU_PUNYCODE
  - writeout: add %{certs} and %{num_certs}
  * Bugfixes:
  - cf-socket: keep sockaddr local in the socket filters
  - cfilters:Curl_conn_get_select_socks: use the first non-connected filter
  - curl.h: allow up to 10M buffer size
  - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated
  - curl/websockets.h: extend the websocket frame struct
  - curl: output warning at --verbose output for debug-enabled version
  - curl_free.3: fix return type of `curl_free`
  - curl_log: for failf/infof and debug logging implementations
  - dict: URL decode the entire path always
  - docs/DEPRECATE.md: deprecate gskit
  - easyoptions: fix header printing in generation script
  - haxproxy: send before TLS handhshake
  - hsts.d: explain hsts more
  - hsts: handle adding the same host name again
  - HTTP/[23]: continue upload when state.drain is set
  - http: decode transfer encoding first
  - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro
  - http_proxy: do not assign data-&gt;req.p.http use local copy
  - lib: connect/h2/h3 refactor
  - libssh2: try sha2 algos for hostkey methods
  - md4: fix build with GnuTLS + OpenSSL v1
  - ngtcp2: replace removed define and stop using removed function
  - noproxy: support for space-separated names is deprecated
  - nss: implement data_pending method
  - openldap: fix missing sasl symbols at build in specific configs
  - openssl: adapt to boringssl's error code type
  - openssl: don't ignore CA paths when using Windows CA store (redux)
  - openssl: don't log raw record headers
  - openssl: make the BIO_METHOD a local variable in the connection filter
  - openssl: only use CA_BLOB if verifying peer
  - openssl: remove attached easy handles from SSL instances
  - openssl: store the CA after first send (ClientHello)
  - setopt: use &gt;, not &gt;=, when checking if uarg is larger than uint-max
  - smb: return error on upload without size
  - socketpair: allow localhost MITM sniffers
  - strdup: name it Curl_strdup
  - tool_getparam: fix hiding of command line secrets
  - tool_operate: fix error codes on bad URL &amp; OOM
  - tool_operate: repair --rate
  - transfer: break the read loop when RECV is cleared
  - typecheck: accept expressions for option/info parameters
  - urlapi: avoid Curl_dyn_addf() for hex outputs
  - urlapi: skip path checks if path is just "/"
  - urlapi: skip the extra dedotdot alloc if no dot in path
  - urldata: cease storing TLS auth type
  - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP
  - urldata: make set.http200aliases conditional on HTTP being present
  - urldata: move the cookefilelist to the 'set' struct
  - urldata: remove unused struct fields, made more conditional
  - vquic: stabilization and improvements
  - vtls: fix hostname handling in filters
  - vtls: manage current easy handle in nested cfilter calls
  - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used
  * Rebase libcurl-ocloexec.patch
  * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091
  - runtests: fix "uninitialized value $port"
  - Add curl-fix-uninitialized-value-in-tests.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1676894400">- Update to 7.88.1:
  * Bugfix release
- Drop upstreamed patch:
  * curl-fix-uninitialized-value-in-tests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678708800">- Security fixes:
  * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection
    Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch
  * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy
    Add curl-CVE-2023-27534.patch
  * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse
    Add curl-CVE-2023-27535.patch
  * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use
    Add curl-CVE-2023-27536.patch
  * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still
    Add curl-CVE-2023-27538.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1679313600">- Update to 8.0.0:
  * Security fixes:
  - TELNET option IAC injection [bsc#1209209, CVE-2023-27533]
  - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534]
  - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535]
  - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536]
  - HSTS double-free [bsc#1209213, CVE-2023-27537]
  - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538]
  * Changes:
  - build: remove support for curl_off_t &lt; 8 bytes
  * Bugfixes:
  - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3
  - BINDINGS: add Fortran binding
  - cf-socket: use port 80 when resolving name for local bind
  - cookie: don't load cookies again when flushing
  - curl_path: create the new path with dynbuf
  - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe
  - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure
  - ftp: active mode with SSL, add the filter
  - hostip: avoid sscanf and extra buffer copies
  - http2: fix for http2-prior-knowledge when reusing connections
  - http2: fix handling of RST and GOAWAY to recognize partial transfers
  - http: don't send 100-continue for short PUT requests
  - http: fix unix domain socket use in https connects
  - libssh: use dynbuf instead of realloc
  - ngtcp2-gnutls.yml: bump to gnutls 3.8.0
  - sectransp: make read_cert() use a dynbuf when loading
  - telnet: only accept option arguments in ascii
  - telnet: parse telnet options without sscanf
  - url: fix the SSH connection reuse check
  - url: only reuse connections with same GSS delegation
  - urlapi: '%' is illegal in host names
  - ws: keep the socket non-blocking
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1679400000">- Update to 8.0.1:
  * Bugfixes:
  - fix crash in curl_easy_cleanup</changelog>
  <changelog author="pmonreal@suse.com" date="1681732800">- Update to 8.0.1: [jsc#PED-2580]
  * Rebase curl-secure-getenv.patch
  * Remove patches fixed in the update:
  - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch
  - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch
  - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch
  - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch
  - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch
  - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch
  - curl-CVE-2022-27774-disabletest-1568.patch
  - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch
  - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch
  - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch
  - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch
  - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch
  - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1683633600">- Security fixes:
  * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256
    fingerprint check.
  - Add curl-CVE-2023-28319.patch
  * [bsc#1211231, CVE-2023-28320] siglongjmp race condition
  - Add curl-CVE-2023-28320.patch
  * [bsc#1211232, CVE-2023-28321] IDN wildcard matching
  - Add curl-CVE-2023-28321.patch
  * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion
  - Add curl-CVE-2023-28322.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1689163200">- Security fix: [bsc#1213237, CVE-2023-32001]
  * fopen race condition: libcurl can be told to save cookie,
    HSTS and/or alt-svc data to files. When doing this, it
    called 'stat()' followed by 'fopen()' in a way that made
    it vulnerable to a TOCTOU race condition problem.
  * Add curl-CVE-2023-32001.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1694001600">- Security fix: [bsc#1215026, CVE-2023-38039]
  * http: return error when receiving too large header
  * Add curl-CVE-2023-38039.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1696334400">- Security fixes:
  * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow
  * [bsc#1215889, CVE-2023-38546] Cookie injection with none file
  * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch</changelog>
</package>
<package pkgid="72363230c782bc8139584f7b6c661a07fe42554b441b17656d70a47370691c15" name="libcurl4" arch="s390x">
  <version epoch="0" ver="8.0.1" rel="150400.5.32.1"/>
  <changelog author="pmonreal@suse.com" date="1664539200">- Change the deprecated configure option --enable-hidden-symbols
  to the new --enable-symbol-hiding.</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665230400">- Update connection info when using UNIX socket as endpoint
  connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666785600">- Update to 7.86.0:
  * Security fixes:
  - POST following PUT confusion [bsc#1204383, CVE-2022-32221]
  - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260]
  - HTTP proxy double-free [bsc#1204385, CVE-2022-42915]
  - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916]
  * Changes:
  - NPN: remove support for and use of
  - Websockets: initial support
  * Bugfixes:
  - altsvc: reject bad port numbers
  - autotools: reduce brute-force when detecting recv/send arg list
  - aws_sigv4: fix header computation
  - cli tool: do not use disabled protocols
  - connect: change verbose IPv6 address:port to [address]:port
  - connect: fix builds without AF_INET6
  - connect: fix Curl_updateconninfo for TRNSPRT_UNIX
  - connect: fix the wrong error message on connect failures
  - content_encoding: use writer struct subclasses for different encodings
  - cookie: reject cookie names or content with TAB characters
  - curl/add_file_name_to_url: use the libcurl URL parser
  - curl/get_url_file_name: use libcurl URL parser
  - curl: warn for --ssl use, considered insecure
  - docs/libcurl/symbols-in-versions: add several missing symbols
  - ftp: ignore a 550 response to MDTM
  - functypes: provide the recv and send arg and return types
  - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled
  - header: define public API functions as extern c
  - headers: reset the requests counter at transfer start
  - hostip: guard PF_INET6 use
  - hostip: lazily wait to figure out if IPv6 works until needed
  - http, vauth: always provide Curl_allow_auth_to_host() functionality
  - http2: make nghttp2 less picky about field whitespace
  - http: try parsing Retry-After: as a number first
  - http_proxy: restore the protocol pointer on error
  - lib: add missing limits.h includes
  - lib: prepare the incoming of additional protocols
  - lib: sanitize conditional exclusion around MIME
  - libssh: if sftp_init fails, don't get the sftp error code
  - mprintf: reject two kinds of precision for the same argument
  - mqtt: return error for too long topic
  - netrc: compare user name case sensitively
  - netrc: replace fgets with Curl_get_line
  - netrc: use the URL-decoded user
  - ngtcp2: fix build errors due to changes in ngtcp2 library
  - noproxy: support proxies specified using cidr notation
  - openssl: make certinfo available for QUIC
  - resolve: make forced IPv4 resolve only use A queries
  - schannel: ban server ALPN change during recv renegotiation
  - schannel: don't reset recv/send function pointers on renegotiation
  - schannel: when importing PFX, disable key persistence
  - setopt: use the handler table for protocol name to number conversions
  - setopt: when POST is set, reset the 'upload' field
  - single_transfer: use the libcurl URL parser when appending query parts
  - smb: replace CURL_WIN32 with WIN32
  - tool: avoid generating ambiguous escaped characters in --libcurl
  - tool_main: exit at once if out of file descriptors
  - tool_operate: more transfer cleanup after parallel transfer fail
  - tool_operate: prevent over-queuing in parallel mode
  - tool_paramhelp: asserts verify maximum sizes for string loading
  - tool_xattr: save the original URL, not the final redirected one
  - url: a zero-length userinfo part in the URL is still a (blank) user
  - url: allow non-HTTPS HSTS-matching for debug builds
  - url: rename function due to name-clash in Watt-32
  - url: use IDN decoded names for HSTS checks
  - urlapi: detect scheme better when not guessing
  - urlapi: fix parsing URL without slash with CURLU_URLENCODE
  - urlapi: reject more bad characters from the host name field
  * Remove patch upstream:
  - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch</changelog>
  <changelog author="luc14n0@opensuse.org" date="1668600000">- Add 1.50.0 as the minimum libnghttp2 build requirement version as
  a bandaid. Curl's 7.86.0 release introduces the use of
  nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation,
  introduced by nghttp2 1.50.0 release, without introducing a check
  for the function/right version in their build scripts. This will
  make Zypper/cURL unusable in some corner cases where users
  installing something that requires libcurl4 before doing full
  system upgrade, thus updating the cURL stack, but not
  libnghttp2's. Background: boo#1204983, Factory mailing list
  threadd:
  "? broken dependency in curl and/or *zyp* ?", and forums thread:
  Curl-is-broken-after-an-update-which-subsequently-breaks-zypper.</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
  <changelog author="david.anes@suse.com" date="1671624000">- Update to 7.87.0:
  * Security fixes:
  - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN
  - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free
  * Changes
  - curl: add --url-query
  - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit
  - lib: add CURL_WRITEFUNC_ERROR to signal write callback error
  - openssl: reduce CA certificate bundle reparsing by caching
  - version: add a feature names array to curl_version_info_data
  * Bugfixes
  - altsvc: fix rejection of negative port numbers
  - aws_sigv4: consult x-%s-content-sha256 for payload hash
  - aws_sigv4: fix typos in aws_sigv4.c
  - base64: better alloc size
  - base64: encode without using snprintf
  - base64: faster base64 decoding
  - build: assume assert.h is always available
  - build: assume errno.h is always available
  - c-hyper: CONNECT respones are not server responses
  - c-hyper: fix multi-request mechanism
  - CI: Change FreeBSD image from 12.3 to 12.4
  - CI: LGTM.com will be shut down in December 2022
  - ci: Remove zuul fuzzing job as it's superseded by CIFuzz
  - cmake: check for cross-compile, not for toolchain
  - CMake: fix build with `CURL_USE_GSSAPI`
  - cmake: really enable warnings with clang
  - cmake: set the soname on the shared library
  - cmdline-opts/gen.pl: fix the linkifier
  - cmdline-opts/page-footer: remove long option nroff formatting
  - config-mac: define HAVE_SYS_IOCTL_H
  - config-mac: fix typo: size_T -&gt; size_t
  - config-mac: remove HAVE_SYS_SELECT_H
  - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW
  - configure: require fork for NTLM-WB
  - contributors.sh: actually use $CURLWWW instead of just setting it
  - cookie: compare cookie prefixes case insensitively
  - cookie: expire cookies at once when max-age is negative
  - cookie: open cookie jar as a binary file
  - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS
  - curl-rustls.m4: on macOS, rustls also needs the Security framework
  - curl.h: include &lt;sys/select.h&gt; on SerenityOS
  - curl.h: name all public function parameters
  - curl.h: reword comment to not use deprecated option
  - curl: override the numeric locale and set "C" by force
  - curl: timeout in the read callback
  - curl_endian: remove Curl_write64_le from header
  - curl_get_line: allow last line without newline char
  - curl_path: do not add '/' if homedir ends with one
  - curl_url_get.3: remove spurious backtick
  - curl_url_set.3: document CURLU_DISALLOW_USER
  - curl_url_set.3: fix typo
  - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE
  - CURLOPT_COOKIEFILE.3: advice =&gt; advise
  - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example
  - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw"
  - CURLOPT_POST.3: Explain setting to 0 changes request type
  - docs/curl_ws_send: Fixed typo in websocket docs
  - docs/EARLY-RELEASE.md: how to determine an early release
  - docs/examples: spell correction ('Retrieve')
  - docs/INSTALL.md: expand on static builds
  - docs/WEBSOCKET.md: explain the URL use
  - docs: add missing parameters for --retry flag
  - docs: add more "SEE ALSO" links to CA related pages
  - docs: explain the noproxy CIDR notation support
  - docs: extend the dump-header documentation
  - docs: remove performance note in CURLOPT_SSL_VERIFYPEER
  - examples/10-at-a-time: fix possible skipped final transfers
  - examples: update descriptions
  - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH
  - gen.pl: do not generate CURLHELP bitmask lines &gt; 79 characters
  - GHA: clarify workflows permissions, set least possible privilege
  - GHA: NSS use clang instead of clang-9
  - gnutls: use common gnutls init and verify code for ngtcp2
  - headers: add endif comments
  - HTTP-COOKIES.md: mention that http://localhost is a secure context
  - HTTP-COOKIES.md: update the 6265bis link to draft-11
  - http: do not send PROXY more than once
  - http: fix the ::1 comparison for IPv6 localhost for cookies
  - http: set 'this_is_a_follow' in the Location: logic
  - http: use the IDN decoded name in HSTS checks
  - hyper: classify headers as CONNECT and 1XX
  - hyper: fix handling of hyper_task's when reusing the same address
  - idn: remove Curl_win32_ascii_to_idn
  - INSTALL: update operating systems and CPU archs
  - KNOWN_BUGS: remove eight entries
  - lib1560: add some basic IDN host name tests
  - lib: connection filters (cfilter) addition to curl:
  - lib: feature deprecation warnings in gcc &gt;= 4.3
  - lib: fix some type mismatches and remove unneeded typecasts
  - lib: parse numbers with fixed known base 10
  - lib: remove bad set.opt_no_body assignments
  - lib: rewind BEFORE request instead of AFTER previous
  - lib: sync guard for Curl_getaddrinfo_ex() definition and use
  - lib: use size_t or int etc instead of longs
  - libcurl-errors.3: remove duplicate word
  - libssh2: return error when ssh_hostkeyfunc returns error
  - limit-rate.d: see also --rate
  - log2changes.pl: wrap long lines at 80 columns
  - Makefile.mk: address minor issues
  - Makefile.mk: improve a GNU Make hack
  - Makefile.mk: portable Makefile.m32
  - maketgz: set the right version in lib/libcurl.plist
  - mime: relax easy/mime structures binding
  - misc: Fix incorrect spelling
  - misc: remove duplicated include files
  - misc: typo and grammar fixes
  - negtelnetserver.py: have it call its close() method
  - netrc.d: provide mutext info
  - netware: remove leftover traces
  - noproxy: also match with adjacent comma
  - noproxy: guard against empty hostnames in noproxy check
  - noproxy: tailmatch like in 7.85.0 and earlier
  - nroff-scan.pl: detect double highlights
  - ntlm: improve comment for encrypt_des
  - ntlm: silence ubsan warning about copying from null target_info pointer
  - openssl/mbedtls: use %d for outputing port with failf (int)
  - openssl: prefix errors with '[lib]/[version]: '
  - os400: use platform socklen_t in Curl_getnameinfo_a
  - page-header: grammar improvement (display transfer rate)
  - proxy: refactor haproxy protocol handling as connection filter
  - README.md: remove badges and xmas-tree garnish
  - rtsp: fix RTSP auth
  - runtests: --no-debuginfod now disables DEBUGINFOD_URLS
  - runtests: do CRLF replacements per section only
  - scripts/checksrc.pl: detect duplicated include files
  - sendf: change Curl_read_plain to wrap Curl_recv_plain
  - sendf: remove unnecessary if condition
  - setup: do not require __MRC__ defined for Mac OS 9 builds
  - smb/telnet: do not free the protocol struct in *_done()
  - socks: fix username max size is 255 (0xFF)
  - spellcheck.words: remove 'github' as an accepted word
  - ssl-reqd.d: clarify that this is for upgrading connections only
  - strcase: use curl_str(n)equal for case insensitive matches
  - styled-output.d: this option does not work on Windows
  - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS
  - system.h: support 64-bit curl_off_t for NonStop 32-bit
  - test1421: fix typo
  - test3026: reduce runtime in legacy mingw builds
  - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+
  - tests: add authorityInfoAccess to generated certs
  - tests: add HTTP/3 test case, custom location for proper nghttpx
  - tls: backends use connection filters for IO, enabling HTTPS-proxy
  - tool: determine the correct fopen option for -D
  - tool_cfgable: free the ssl_ec_curves on exit
  - tool_cfgable: make socks5_gssapi_nec a boolean
  - tool_formparse: avoid clobbering on function params
  - tool_getparam: make --no-get work as the opposite of --get
  - tool_operate: provide better errmsg for -G with bad URL
  - tool_operate: when aborting, make sure there is a non-NULL error buffer
  - tool_paramhlp: free the proto strings on exit
  - url: move back the IDN conversion of proxy names
  - urlapi: reject more bad letters from the host name: &amp;+()
  - urldata: change port num storage to int and unsigned short
  - vms: remove SIZEOF_SHORT
  - vtls: fix build without proxy support
  - vtls: localization of state data in filters
  - WEBSOCKET.md: fix broken link
  - Websocket: fixes for partial frames and buffer updates
  - websockets: fix handling of partial frames
  - windows: fail early with a missing windres in autotools
  - windows: fix linking .rc to shared curl with autotools
  - winidn: drop WANT_IDN_PROTOTYPES
  - ws: if no connection is around, return error
  - ws: return CURLE_NOT_BUILT_IN when websockets not built in
  - x509asn1: avoid freeing unallocated pointers</changelog>
  <changelog author="pmonreal@suse.com" date="1675771200">- Security Fixes:
  * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914]
  * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915]
  * Add curl-CVE-2023-23914-23915.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771201">- Security Fix: [bsc#1207992, CVE-2023-23916]
  * HTTP multi-header compression denial of service
  * Add curl-CVE-2023-23916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1676462400">- Update to 7.88.0: [bsc#1207990, CVE-2023-23914]
  [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916]
  * Security fixes:
  - CVE-2023-23914: HSTS ignored on multiple requests
  - CVE-2023-23915: HSTS amnesia with --parallel
  - CVE-2023-23916: HTTP multi-header compression denial of service
  * Changes:
  - curl.h: add CURL_HTTP_VERSION_3ONLY
  - share: add sharing of HSTS cache among handles
  - src: add --http3-only
  - tool_operate: share HSTS between handles
  - urlapi: add CURLU_PUNYCODE
  - writeout: add %{certs} and %{num_certs}
  * Bugfixes:
  - cf-socket: keep sockaddr local in the socket filters
  - cfilters:Curl_conn_get_select_socks: use the first non-connected filter
  - curl.h: allow up to 10M buffer size
  - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated
  - curl/websockets.h: extend the websocket frame struct
  - curl: output warning at --verbose output for debug-enabled version
  - curl_free.3: fix return type of `curl_free`
  - curl_log: for failf/infof and debug logging implementations
  - dict: URL decode the entire path always
  - docs/DEPRECATE.md: deprecate gskit
  - easyoptions: fix header printing in generation script
  - haxproxy: send before TLS handhshake
  - hsts.d: explain hsts more
  - hsts: handle adding the same host name again
  - HTTP/[23]: continue upload when state.drain is set
  - http: decode transfer encoding first
  - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro
  - http_proxy: do not assign data-&gt;req.p.http use local copy
  - lib: connect/h2/h3 refactor
  - libssh2: try sha2 algos for hostkey methods
  - md4: fix build with GnuTLS + OpenSSL v1
  - ngtcp2: replace removed define and stop using removed function
  - noproxy: support for space-separated names is deprecated
  - nss: implement data_pending method
  - openldap: fix missing sasl symbols at build in specific configs
  - openssl: adapt to boringssl's error code type
  - openssl: don't ignore CA paths when using Windows CA store (redux)
  - openssl: don't log raw record headers
  - openssl: make the BIO_METHOD a local variable in the connection filter
  - openssl: only use CA_BLOB if verifying peer
  - openssl: remove attached easy handles from SSL instances
  - openssl: store the CA after first send (ClientHello)
  - setopt: use &gt;, not &gt;=, when checking if uarg is larger than uint-max
  - smb: return error on upload without size
  - socketpair: allow localhost MITM sniffers
  - strdup: name it Curl_strdup
  - tool_getparam: fix hiding of command line secrets
  - tool_operate: fix error codes on bad URL &amp; OOM
  - tool_operate: repair --rate
  - transfer: break the read loop when RECV is cleared
  - typecheck: accept expressions for option/info parameters
  - urlapi: avoid Curl_dyn_addf() for hex outputs
  - urlapi: skip path checks if path is just "/"
  - urlapi: skip the extra dedotdot alloc if no dot in path
  - urldata: cease storing TLS auth type
  - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP
  - urldata: make set.http200aliases conditional on HTTP being present
  - urldata: move the cookefilelist to the 'set' struct
  - urldata: remove unused struct fields, made more conditional
  - vquic: stabilization and improvements
  - vtls: fix hostname handling in filters
  - vtls: manage current easy handle in nested cfilter calls
  - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used
  * Rebase libcurl-ocloexec.patch
  * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091
  - runtests: fix "uninitialized value $port"
  - Add curl-fix-uninitialized-value-in-tests.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1676894400">- Update to 7.88.1:
  * Bugfix release
- Drop upstreamed patch:
  * curl-fix-uninitialized-value-in-tests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678708800">- Security fixes:
  * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection
    Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch
  * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy
    Add curl-CVE-2023-27534.patch
  * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse
    Add curl-CVE-2023-27535.patch
  * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use
    Add curl-CVE-2023-27536.patch
  * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still
    Add curl-CVE-2023-27538.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1679313600">- Update to 8.0.0:
  * Security fixes:
  - TELNET option IAC injection [bsc#1209209, CVE-2023-27533]
  - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534]
  - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535]
  - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536]
  - HSTS double-free [bsc#1209213, CVE-2023-27537]
  - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538]
  * Changes:
  - build: remove support for curl_off_t &lt; 8 bytes
  * Bugfixes:
  - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3
  - BINDINGS: add Fortran binding
  - cf-socket: use port 80 when resolving name for local bind
  - cookie: don't load cookies again when flushing
  - curl_path: create the new path with dynbuf
  - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe
  - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure
  - ftp: active mode with SSL, add the filter
  - hostip: avoid sscanf and extra buffer copies
  - http2: fix for http2-prior-knowledge when reusing connections
  - http2: fix handling of RST and GOAWAY to recognize partial transfers
  - http: don't send 100-continue for short PUT requests
  - http: fix unix domain socket use in https connects
  - libssh: use dynbuf instead of realloc
  - ngtcp2-gnutls.yml: bump to gnutls 3.8.0
  - sectransp: make read_cert() use a dynbuf when loading
  - telnet: only accept option arguments in ascii
  - telnet: parse telnet options without sscanf
  - url: fix the SSH connection reuse check
  - url: only reuse connections with same GSS delegation
  - urlapi: '%' is illegal in host names
  - ws: keep the socket non-blocking
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1679400000">- Update to 8.0.1:
  * Bugfixes:
  - fix crash in curl_easy_cleanup</changelog>
  <changelog author="pmonreal@suse.com" date="1681732800">- Update to 8.0.1: [jsc#PED-2580]
  * Rebase curl-secure-getenv.patch
  * Remove patches fixed in the update:
  - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch
  - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch
  - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch
  - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch
  - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch
  - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch
  - curl-CVE-2022-27774-disabletest-1568.patch
  - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch
  - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch
  - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch
  - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch
  - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch
  - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1683633600">- Security fixes:
  * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256
    fingerprint check.
  - Add curl-CVE-2023-28319.patch
  * [bsc#1211231, CVE-2023-28320] siglongjmp race condition
  - Add curl-CVE-2023-28320.patch
  * [bsc#1211232, CVE-2023-28321] IDN wildcard matching
  - Add curl-CVE-2023-28321.patch
  * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion
  - Add curl-CVE-2023-28322.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1689163200">- Security fix: [bsc#1213237, CVE-2023-32001]
  * fopen race condition: libcurl can be told to save cookie,
    HSTS and/or alt-svc data to files. When doing this, it
    called 'stat()' followed by 'fopen()' in a way that made
    it vulnerable to a TOCTOU race condition problem.
  * Add curl-CVE-2023-32001.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1694001600">- Security fix: [bsc#1215026, CVE-2023-38039]
  * http: return error when receiving too large header
  * Add curl-CVE-2023-38039.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1696334400">- Security fixes:
  * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow
  * [bsc#1215889, CVE-2023-38546] Cookie injection with none file
  * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch</changelog>
</package>
<package pkgid="14901f528d8e28d37214ef02b72883fdd6f281abfc3a1ef7fe8d9c14b71c5ca9" name="libcurl4" arch="x86_64">
  <version epoch="0" ver="8.0.1" rel="150400.5.32.1"/>
  <changelog author="pmonreal@suse.com" date="1664539200">- Change the deprecated configure option --enable-hidden-symbols
  to the new --enable-symbol-hiding.</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1665230400">- Update connection info when using UNIX socket as endpoint
  connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666008000">- Security Fix: [bsc#1204383, CVE-2022-32221]
  * POST following PUT confusion
  * Add curl-CVE-2022-32221.patch
- Security Fix: [bsc#1204386, CVE-2022-42916]
  * HSTS bypass via IDN
  * Add curl-CVE-2022-42916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1666785600">- Update to 7.86.0:
  * Security fixes:
  - POST following PUT confusion [bsc#1204383, CVE-2022-32221]
  - .netrc parser out-of-bounds access [bsc#1204384, CVE-2022-35260]
  - HTTP proxy double-free [bsc#1204385, CVE-2022-42915]
  - HSTS bypass via IDN [bsc#1204386, CVE-2022-42916]
  * Changes:
  - NPN: remove support for and use of
  - Websockets: initial support
  * Bugfixes:
  - altsvc: reject bad port numbers
  - autotools: reduce brute-force when detecting recv/send arg list
  - aws_sigv4: fix header computation
  - cli tool: do not use disabled protocols
  - connect: change verbose IPv6 address:port to [address]:port
  - connect: fix builds without AF_INET6
  - connect: fix Curl_updateconninfo for TRNSPRT_UNIX
  - connect: fix the wrong error message on connect failures
  - content_encoding: use writer struct subclasses for different encodings
  - cookie: reject cookie names or content with TAB characters
  - curl/add_file_name_to_url: use the libcurl URL parser
  - curl/get_url_file_name: use libcurl URL parser
  - curl: warn for --ssl use, considered insecure
  - docs/libcurl/symbols-in-versions: add several missing symbols
  - ftp: ignore a 550 response to MDTM
  - functypes: provide the recv and send arg and return types
  - getparameter: return PARAM_MANUAL_REQUESTED for -M even when disabled
  - header: define public API functions as extern c
  - headers: reset the requests counter at transfer start
  - hostip: guard PF_INET6 use
  - hostip: lazily wait to figure out if IPv6 works until needed
  - http, vauth: always provide Curl_allow_auth_to_host() functionality
  - http2: make nghttp2 less picky about field whitespace
  - http: try parsing Retry-After: as a number first
  - http_proxy: restore the protocol pointer on error
  - lib: add missing limits.h includes
  - lib: prepare the incoming of additional protocols
  - lib: sanitize conditional exclusion around MIME
  - libssh: if sftp_init fails, don't get the sftp error code
  - mprintf: reject two kinds of precision for the same argument
  - mqtt: return error for too long topic
  - netrc: compare user name case sensitively
  - netrc: replace fgets with Curl_get_line
  - netrc: use the URL-decoded user
  - ngtcp2: fix build errors due to changes in ngtcp2 library
  - noproxy: support proxies specified using cidr notation
  - openssl: make certinfo available for QUIC
  - resolve: make forced IPv4 resolve only use A queries
  - schannel: ban server ALPN change during recv renegotiation
  - schannel: don't reset recv/send function pointers on renegotiation
  - schannel: when importing PFX, disable key persistence
  - setopt: use the handler table for protocol name to number conversions
  - setopt: when POST is set, reset the 'upload' field
  - single_transfer: use the libcurl URL parser when appending query parts
  - smb: replace CURL_WIN32 with WIN32
  - tool: avoid generating ambiguous escaped characters in --libcurl
  - tool_main: exit at once if out of file descriptors
  - tool_operate: more transfer cleanup after parallel transfer fail
  - tool_operate: prevent over-queuing in parallel mode
  - tool_paramhelp: asserts verify maximum sizes for string loading
  - tool_xattr: save the original URL, not the final redirected one
  - url: a zero-length userinfo part in the URL is still a (blank) user
  - url: allow non-HTTPS HSTS-matching for debug builds
  - url: rename function due to name-clash in Watt-32
  - url: use IDN decoded names for HSTS checks
  - urlapi: detect scheme better when not guessing
  - urlapi: fix parsing URL without slash with CURLU_URLENCODE
  - urlapi: reject more bad characters from the host name field
  * Remove patch upstream:
  - connect-fix-Curl_updateconninfo-for-TRNSPRT_UNIX.patch</changelog>
  <changelog author="luc14n0@opensuse.org" date="1668600000">- Add 1.50.0 as the minimum libnghttp2 build requirement version as
  a bandaid. Curl's 7.86.0 release introduces the use of
  nghttp2_option_set_no_rfc9113_leading_and_trailing_ws_validation,
  introduced by nghttp2 1.50.0 release, without introducing a check
  for the function/right version in their build scripts. This will
  make Zypper/cURL unusable in some corner cases where users
  installing something that requires libcurl4 before doing full
  system upgrade, thus updating the cURL stack, but not
  libnghttp2's. Background: boo#1204983, Factory mailing list
  threadd:
  "? broken dependency in curl and/or *zyp* ?", and forums thread:
  Curl-is-broken-after-an-update-which-subsequently-breaks-zypper.</changelog>
  <changelog author="pmonreal@suse.com" date="1670846400">- Security Fix: [bsc#1206308, CVE-2022-43551]
  * Fix Another HSTS bypass via IDN
  * Add curl-CVE-2022-43551.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1670846401">- Security Fix: [bsc#1206309, CVE-2022-43552]
  * HTTP Proxy deny use-after-free
  * Add curl-CVE-2022-43552.patch</changelog>
  <changelog author="david.anes@suse.com" date="1671624000">- Update to 7.87.0:
  * Security fixes:
  - CVE-2022-43551, bsc#1206308: another HSTS bypass via IDN
  - CVE-2022-43552, bsc#1206309: HTTP Proxy deny use-after-free
  * Changes
  - curl: add --url-query
  - CURLOPT_QUICK_EXIT: don't wait for DNS thread on exit
  - lib: add CURL_WRITEFUNC_ERROR to signal write callback error
  - openssl: reduce CA certificate bundle reparsing by caching
  - version: add a feature names array to curl_version_info_data
  * Bugfixes
  - altsvc: fix rejection of negative port numbers
  - aws_sigv4: consult x-%s-content-sha256 for payload hash
  - aws_sigv4: fix typos in aws_sigv4.c
  - base64: better alloc size
  - base64: encode without using snprintf
  - base64: faster base64 decoding
  - build: assume assert.h is always available
  - build: assume errno.h is always available
  - c-hyper: CONNECT respones are not server responses
  - c-hyper: fix multi-request mechanism
  - CI: Change FreeBSD image from 12.3 to 12.4
  - CI: LGTM.com will be shut down in December 2022
  - ci: Remove zuul fuzzing job as it's superseded by CIFuzz
  - cmake: check for cross-compile, not for toolchain
  - CMake: fix build with `CURL_USE_GSSAPI`
  - cmake: really enable warnings with clang
  - cmake: set the soname on the shared library
  - cmdline-opts/gen.pl: fix the linkifier
  - cmdline-opts/page-footer: remove long option nroff formatting
  - config-mac: define HAVE_SYS_IOCTL_H
  - config-mac: fix typo: size_T -&gt; size_t
  - config-mac: remove HAVE_SYS_SELECT_H
  - config-win32: fix SIZEOF_OFF_T for MSVC and old MinGW
  - configure: require fork for NTLM-WB
  - contributors.sh: actually use $CURLWWW instead of just setting it
  - cookie: compare cookie prefixes case insensitively
  - cookie: expire cookies at once when max-age is negative
  - cookie: open cookie jar as a binary file
  - curl-openssl.m4: do not add $prefix/include/openssl to CPPFLAGS
  - curl-rustls.m4: on macOS, rustls also needs the Security framework
  - curl.h: include &lt;sys/select.h&gt; on SerenityOS
  - curl.h: name all public function parameters
  - curl.h: reword comment to not use deprecated option
  - curl: override the numeric locale and set "C" by force
  - curl: timeout in the read callback
  - curl_endian: remove Curl_write64_le from header
  - curl_get_line: allow last line without newline char
  - curl_path: do not add '/' if homedir ends with one
  - curl_url_get.3: remove spurious backtick
  - curl_url_set.3: document CURLU_DISALLOW_USER
  - curl_url_set.3: fix typo
  - CURLMOPT_SOCKETFUNCTION.3: clarify CURL_POLL_REMOVE
  - CURLOPT_COOKIEFILE.3: advice =&gt; advise
  - CURLOPT_DEBUGFUNCTION.3: do not assume nul-termination in example
  - CURLOPT_DEBUGFUNCTION.3: emphasize that incoming data is "raw"
  - CURLOPT_POST.3: Explain setting to 0 changes request type
  - docs/curl_ws_send: Fixed typo in websocket docs
  - docs/EARLY-RELEASE.md: how to determine an early release
  - docs/examples: spell correction ('Retrieve')
  - docs/INSTALL.md: expand on static builds
  - docs/WEBSOCKET.md: explain the URL use
  - docs: add missing parameters for --retry flag
  - docs: add more "SEE ALSO" links to CA related pages
  - docs: explain the noproxy CIDR notation support
  - docs: extend the dump-header documentation
  - docs: remove performance note in CURLOPT_SSL_VERIFYPEER
  - examples/10-at-a-time: fix possible skipped final transfers
  - examples: update descriptions
  - ftp: support growing files with CURLOPT_IGNORE_CONTENT_LENGTH
  - gen.pl: do not generate CURLHELP bitmask lines &gt; 79 characters
  - GHA: clarify workflows permissions, set least possible privilege
  - GHA: NSS use clang instead of clang-9
  - gnutls: use common gnutls init and verify code for ngtcp2
  - headers: add endif comments
  - HTTP-COOKIES.md: mention that http://localhost is a secure context
  - HTTP-COOKIES.md: update the 6265bis link to draft-11
  - http: do not send PROXY more than once
  - http: fix the ::1 comparison for IPv6 localhost for cookies
  - http: set 'this_is_a_follow' in the Location: logic
  - http: use the IDN decoded name in HSTS checks
  - hyper: classify headers as CONNECT and 1XX
  - hyper: fix handling of hyper_task's when reusing the same address
  - idn: remove Curl_win32_ascii_to_idn
  - INSTALL: update operating systems and CPU archs
  - KNOWN_BUGS: remove eight entries
  - lib1560: add some basic IDN host name tests
  - lib: connection filters (cfilter) addition to curl:
  - lib: feature deprecation warnings in gcc &gt;= 4.3
  - lib: fix some type mismatches and remove unneeded typecasts
  - lib: parse numbers with fixed known base 10
  - lib: remove bad set.opt_no_body assignments
  - lib: rewind BEFORE request instead of AFTER previous
  - lib: sync guard for Curl_getaddrinfo_ex() definition and use
  - lib: use size_t or int etc instead of longs
  - libcurl-errors.3: remove duplicate word
  - libssh2: return error when ssh_hostkeyfunc returns error
  - limit-rate.d: see also --rate
  - log2changes.pl: wrap long lines at 80 columns
  - Makefile.mk: address minor issues
  - Makefile.mk: improve a GNU Make hack
  - Makefile.mk: portable Makefile.m32
  - maketgz: set the right version in lib/libcurl.plist
  - mime: relax easy/mime structures binding
  - misc: Fix incorrect spelling
  - misc: remove duplicated include files
  - misc: typo and grammar fixes
  - negtelnetserver.py: have it call its close() method
  - netrc.d: provide mutext info
  - netware: remove leftover traces
  - noproxy: also match with adjacent comma
  - noproxy: guard against empty hostnames in noproxy check
  - noproxy: tailmatch like in 7.85.0 and earlier
  - nroff-scan.pl: detect double highlights
  - ntlm: improve comment for encrypt_des
  - ntlm: silence ubsan warning about copying from null target_info pointer
  - openssl/mbedtls: use %d for outputing port with failf (int)
  - openssl: prefix errors with '[lib]/[version]: '
  - os400: use platform socklen_t in Curl_getnameinfo_a
  - page-header: grammar improvement (display transfer rate)
  - proxy: refactor haproxy protocol handling as connection filter
  - README.md: remove badges and xmas-tree garnish
  - rtsp: fix RTSP auth
  - runtests: --no-debuginfod now disables DEBUGINFOD_URLS
  - runtests: do CRLF replacements per section only
  - scripts/checksrc.pl: detect duplicated include files
  - sendf: change Curl_read_plain to wrap Curl_recv_plain
  - sendf: remove unnecessary if condition
  - setup: do not require __MRC__ defined for Mac OS 9 builds
  - smb/telnet: do not free the protocol struct in *_done()
  - socks: fix username max size is 255 (0xFF)
  - spellcheck.words: remove 'github' as an accepted word
  - ssl-reqd.d: clarify that this is for upgrading connections only
  - strcase: use curl_str(n)equal for case insensitive matches
  - styled-output.d: this option does not work on Windows
  - system.h: fix socklen_t, curl_off_t, long long for Classic Mac OS
  - system.h: support 64-bit curl_off_t for NonStop 32-bit
  - test1421: fix typo
  - test3026: reduce runtime in legacy mingw builds
  - tests/sshserver.pl: re-enable ssh-rsa while using openssh 8.8+
  - tests: add authorityInfoAccess to generated certs
  - tests: add HTTP/3 test case, custom location for proper nghttpx
  - tls: backends use connection filters for IO, enabling HTTPS-proxy
  - tool: determine the correct fopen option for -D
  - tool_cfgable: free the ssl_ec_curves on exit
  - tool_cfgable: make socks5_gssapi_nec a boolean
  - tool_formparse: avoid clobbering on function params
  - tool_getparam: make --no-get work as the opposite of --get
  - tool_operate: provide better errmsg for -G with bad URL
  - tool_operate: when aborting, make sure there is a non-NULL error buffer
  - tool_paramhlp: free the proto strings on exit
  - url: move back the IDN conversion of proxy names
  - urlapi: reject more bad letters from the host name: &amp;+()
  - urldata: change port num storage to int and unsigned short
  - vms: remove SIZEOF_SHORT
  - vtls: fix build without proxy support
  - vtls: localization of state data in filters
  - WEBSOCKET.md: fix broken link
  - Websocket: fixes for partial frames and buffer updates
  - websockets: fix handling of partial frames
  - windows: fail early with a missing windres in autotools
  - windows: fix linking .rc to shared curl with autotools
  - winidn: drop WANT_IDN_PROTOTYPES
  - ws: if no connection is around, return error
  - ws: return CURLE_NOT_BUILT_IN when websockets not built in
  - x509asn1: avoid freeing unallocated pointers</changelog>
  <changelog author="pmonreal@suse.com" date="1675771200">- Security Fixes:
  * HSTS ignored on multiple requests [bsc#1207990, CVE-2023-23914]
  * HSTS amnesia with --parallel [bsc#1207991, CVE-2023-23915]
  * Add curl-CVE-2023-23914-23915.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1675771201">- Security Fix: [bsc#1207992, CVE-2023-23916]
  * HTTP multi-header compression denial of service
  * Add curl-CVE-2023-23916.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1676462400">- Update to 7.88.0: [bsc#1207990, CVE-2023-23914]
  [bsc#1207991, CVE-2023-23915] [bsc#1207992, CVE-2023-23916]
  * Security fixes:
  - CVE-2023-23914: HSTS ignored on multiple requests
  - CVE-2023-23915: HSTS amnesia with --parallel
  - CVE-2023-23916: HTTP multi-header compression denial of service
  * Changes:
  - curl.h: add CURL_HTTP_VERSION_3ONLY
  - share: add sharing of HSTS cache among handles
  - src: add --http3-only
  - tool_operate: share HSTS between handles
  - urlapi: add CURLU_PUNYCODE
  - writeout: add %{certs} and %{num_certs}
  * Bugfixes:
  - cf-socket: keep sockaddr local in the socket filters
  - cfilters:Curl_conn_get_select_socks: use the first non-connected filter
  - curl.h: allow up to 10M buffer size
  - curl.h: mark CURLSSLBACKEND_MESALINK as deprecated
  - curl/websockets.h: extend the websocket frame struct
  - curl: output warning at --verbose output for debug-enabled version
  - curl_free.3: fix return type of `curl_free`
  - curl_log: for failf/infof and debug logging implementations
  - dict: URL decode the entire path always
  - docs/DEPRECATE.md: deprecate gskit
  - easyoptions: fix header printing in generation script
  - haxproxy: send before TLS handhshake
  - hsts.d: explain hsts more
  - hsts: handle adding the same host name again
  - HTTP/[23]: continue upload when state.drain is set
  - http: decode transfer encoding first
  - http_aws_sigv4: remove typecasts from HMAC_SHA256 macro
  - http_proxy: do not assign data-&gt;req.p.http use local copy
  - lib: connect/h2/h3 refactor
  - libssh2: try sha2 algos for hostkey methods
  - md4: fix build with GnuTLS + OpenSSL v1
  - ngtcp2: replace removed define and stop using removed function
  - noproxy: support for space-separated names is deprecated
  - nss: implement data_pending method
  - openldap: fix missing sasl symbols at build in specific configs
  - openssl: adapt to boringssl's error code type
  - openssl: don't ignore CA paths when using Windows CA store (redux)
  - openssl: don't log raw record headers
  - openssl: make the BIO_METHOD a local variable in the connection filter
  - openssl: only use CA_BLOB if verifying peer
  - openssl: remove attached easy handles from SSL instances
  - openssl: store the CA after first send (ClientHello)
  - setopt: use &gt;, not &gt;=, when checking if uarg is larger than uint-max
  - smb: return error on upload without size
  - socketpair: allow localhost MITM sniffers
  - strdup: name it Curl_strdup
  - tool_getparam: fix hiding of command line secrets
  - tool_operate: fix error codes on bad URL &amp; OOM
  - tool_operate: repair --rate
  - transfer: break the read loop when RECV is cleared
  - typecheck: accept expressions for option/info parameters
  - urlapi: avoid Curl_dyn_addf() for hex outputs
  - urlapi: skip path checks if path is just "/"
  - urlapi: skip the extra dedotdot alloc if no dot in path
  - urldata: cease storing TLS auth type
  - urldata: make 'ftp_create_missing_dirs' depend on FTP || SFTP
  - urldata: make set.http200aliases conditional on HTTP being present
  - urldata: move the cookefilelist to the 'set' struct
  - urldata: remove unused struct fields, made more conditional
  - vquic: stabilization and improvements
  - vtls: fix hostname handling in filters
  - vtls: manage current easy handle in nested cfilter calls
  - vtls: use ALPN HTTP/1.0 when HTTP/1.0 is used
  * Rebase libcurl-ocloexec.patch
  * Fix regression tests: f1d09231adfc695d15995b9ef2c8c6e568c28091
  - runtests: fix "uninitialized value $port"
  - Add curl-fix-uninitialized-value-in-tests.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1676894400">- Update to 7.88.1:
  * Bugfix release
- Drop upstreamed patch:
  * curl-fix-uninitialized-value-in-tests.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1678708800">- Security fixes:
  * [bsc#1209209, CVE-2023-27533] TELNET option IAC injection
    Add curl-CVE-2023-27533-no-sscanf.patch curl-CVE-2023-27533.patch
  * [bsc#1209210, CVE-2023-27534] SFTP path ~ resolving discrepancy
    Add curl-CVE-2023-27534.patch
  * [bsc#1209211, CVE-2023-27535] FTP too eager connection reuse
    Add curl-CVE-2023-27535.patch
  * [bsc#1209212, CVE-2023-27536] GSS delegation too eager connection re-use
    Add curl-CVE-2023-27536.patch
  * [bsc#1209214, CVE-2023-27538] SSH connection too eager reuse still
    Add curl-CVE-2023-27538.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1679313600">- Update to 8.0.0:
  * Security fixes:
  - TELNET option IAC injection [bsc#1209209, CVE-2023-27533]
  - SFTP path ~ resolving discrepancy [bsc#1209210, CVE-2023-27534]
  - FTP too eager connection reuse [bsc#1209211, CVE-2023-27535]
  - GSS delegation too eager connection re-use [bsc#1209212, CVE-2023-27536]
  - HSTS double-free [bsc#1209213, CVE-2023-27537]
  - SSH connection too eager reuse still [bsc#1209214, CVE-2023-27538]
  * Changes:
  - build: remove support for curl_off_t &lt; 8 bytes
  * Bugfixes:
  - aws_sigv4: fall back to UNSIGNED-PAYLOAD for sign_as_s3
  - BINDINGS: add Fortran binding
  - cf-socket: use port 80 when resolving name for local bind
  - cookie: don't load cookies again when flushing
  - curl_path: create the new path with dynbuf
  - CURLSHOPT_SHARE.3: HSTS sharing is not thread-safe
  - DYNBUF.md: note Curl_dyn_add* calls Curl_dyn_free on failure
  - ftp: active mode with SSL, add the filter
  - hostip: avoid sscanf and extra buffer copies
  - http2: fix for http2-prior-knowledge when reusing connections
  - http2: fix handling of RST and GOAWAY to recognize partial transfers
  - http: don't send 100-continue for short PUT requests
  - http: fix unix domain socket use in https connects
  - libssh: use dynbuf instead of realloc
  - ngtcp2-gnutls.yml: bump to gnutls 3.8.0
  - sectransp: make read_cert() use a dynbuf when loading
  - telnet: only accept option arguments in ascii
  - telnet: parse telnet options without sscanf
  - url: fix the SSH connection reuse check
  - url: only reuse connections with same GSS delegation
  - urlapi: '%' is illegal in host names
  - ws: keep the socket non-blocking
  * Rebase libcurl-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1679400000">- Update to 8.0.1:
  * Bugfixes:
  - fix crash in curl_easy_cleanup</changelog>
  <changelog author="pmonreal@suse.com" date="1681732800">- Update to 8.0.1: [jsc#PED-2580]
  * Rebase curl-secure-getenv.patch
  * Remove patches fixed in the update:
  - curl-CVE-2022-22576.patch curl-CVE-2022-27776.patch
  - curl-CVE-2022-27781.patch curl-CVE-2022-27782.patch
  - curl-CVE-2022-32206.patch curl-CVE-2022-32208.patch
  - curl-CVE-2022-32221.patch curl-CVE-2022-35252.patch
  - curl-CVE-2022-43552.patch curl-CVE-2023-23916.patch
  - curl-CVE-2022-27774.patch curl-CVE-2022-27774-2.patch
  - curl-CVE-2022-27774-disabletest-1568.patch
  - curl-CVE-2022-27775.patch curl-CVE-2022-32205.patch
  - curl-CVE-2022-32207.patch curl-CVE-2022-42916.patch
  - curl-CVE-2022-43551.patch curl-CVE-2023-23914-23915.patch
  - curl-CVE-2023-27533.patch curl-CVE-2023-27533-no-sscanf.patch
  - curl-CVE-2023-27534.patch curl-CVE-2023-27535.patch
  - curl-CVE-2023-27536.patch curl-CVE-2023-27538.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1683633600">- Security fixes:
  * [bsc#1211230, CVE-2023-28319] use-after-free in SSH sha256
    fingerprint check.
  - Add curl-CVE-2023-28319.patch
  * [bsc#1211231, CVE-2023-28320] siglongjmp race condition
  - Add curl-CVE-2023-28320.patch
  * [bsc#1211232, CVE-2023-28321] IDN wildcard matching
  - Add curl-CVE-2023-28321.patch
  * [bsc#1211233, CVE-2023-28322] POST-after-PUT confusion
  - Add curl-CVE-2023-28322.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1689163200">- Security fix: [bsc#1213237, CVE-2023-32001]
  * fopen race condition: libcurl can be told to save cookie,
    HSTS and/or alt-svc data to files. When doing this, it
    called 'stat()' followed by 'fopen()' in a way that made
    it vulnerable to a TOCTOU race condition problem.
  * Add curl-CVE-2023-32001.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1694001600">- Security fix: [bsc#1215026, CVE-2023-38039]
  * http: return error when receiving too large header
  * Add curl-CVE-2023-38039.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1696334400">- Security fixes:
  * [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow
  * [bsc#1215889, CVE-2023-38546] Cookie injection with none file
  * Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch</changelog>
</package>
<package pkgid="30662160ced050a02b0b8c10efaee7eb01b757f7ce1551ffd9a4c0038bddb0d5" name="libeconf" arch="src">
  <version epoch="0" ver="0.5.2" rel="150400.3.6.1"/>
  <changelog author="rbrown@suse.com" date="1594382400">- Update to version 0.3.8+git20200710.5126fff:
  * Add CMake build scripts, remove autotools support
  * Move C++ ABI compatibility section</changelog>
  <changelog author="lnussel@suse.de" date="1603368000">- explicitly BuildRequire: pkgconfig for /usr/lib/rpm/pkgconfigdeps.sh
  On TW it's pulled in implicitly by libxcrypt-devel which is not the
  case on 15.2</changelog>
  <changelog author="schubi@suse.com" date="1617883200">- Update to version 0.4.0+git20210408.6d33e5e:
  * Man pages libeconf.3 and econftool.8.
  * Handling multiline strings.
  * Added libeconf_ext which returns more information like
    line_nr, comments, path of the configuration file,...
  * Econftool, an command line interface for handling configuration
    files.
  * Generating HTML API documentation with doxygen.
  * Improving error handling and semantic file check.
  * Joining entries with the same key to one single entry if
    env variable ECONF_JOIN_SAME_ENTRIES has been set.</changelog>
  <changelog author="schubi@suse.com" date="1618228800">- Update to version 0.4.0+git20210412.1513a26:
  * Added econftool cat option (#146)
  * new API call: econf_readDirsHistory (showing ALL locations)
  * new API call: econf_getPath (absolute path of the configuration file)</changelog>
  <changelog author="schubi@suse.com" date="1618315200">- Update to version 0.4.0+git20210413.fdb8025:
  * Installing man pages via meson. (#147)</changelog>
  <changelog author="schubi@suse.com" date="1618488000">- Removed doxygen from build requires.</changelog>
  <changelog author="schubi@suse.com" date="1625659200">- Update to version 0.4.0+git20210707.537a8a:
  * Fixed resource leaks found by Iker Pedrosa.</changelog>
  <changelog author="Stefan Schubert schubi@suse.com" date="1625745600">- Update to version 0.4.0+git20210708.6918ea1:
  * Fixed covscan FORWARD_NULL_issues warnings</changelog>
  <changelog author="schubi@localhost" date="1625832000">- Update to version 0.4.1+git20210709.cf671f2:
  * CMake fixes regarding installation of econftool and man pages.</changelog>
  <changelog author="schubi@suse.com" date="1636632000">- Update to version libeconf-0.4.2+git20211111.c7a2c52:
  * CMake fixes regarding document installation.
  * Fixed different issues while writing string values to file.
  * Writing comments to file too.
  * Fixed memory leaks.
  * Fixed crash while merging values.</changelog>
  <changelog author="schubi@suse.com" date="1641297600">- Update to version 0.4.2+git20220104.5dfd69d:
  * Reading numbers with different bases (e.g. oktal) (bsc#1193632) (#157)</changelog>
  <changelog author="schubi@suse.com" date="1641297601">- Update to version 0.4.4+git20220104.962774f:
  * Fixed i586 build (#158)</changelog>
  <changelog author="schubi@suse.com" date="1649246400">- Update to version 0.4.5+git20220406.c9658f2:
  * econftool:
  * * New call "syntax" for checking the configuration files only.
    Returns an error string with line number if an error occurs.
  * * New options "--comment" and "--delimeters"
  * * Parsing one file only if needed.</changelog>
  <changelog author="schubi@suse.com" date="1651060800">- Update to version 0.4.6+git20220427.3016f4e:
  * econftool:
  * * Parsing error: Reporting file and line nr.
  * * --delimeters=spaces Taking all kind of spaces for delimiter
  * libeconf:
    Fixed bsc#1198165: Parsing files correctly which have space characters
    AND none space characters as delimiters.</changelog>
  <changelog author="schubi@suse.com" date="1668427200">- Update to version 0.4.8+git20221114.7ff7704:
  * Parsing files which are containing keys only (#170)
    All delimiters are allowed now : "", " =", " ", "=". But the
    user should use "" in order to be distinct.
  * /usr/etc/shells.d/&lt;file_name&gt; will not be parsed if
    /etc/shells.d/&lt;file_name&gt; is defined too.
  * Lto build fixed (#168)
  * New calls: econf_comment_tag, econf_delimiter_tag, econf_set_comment_tag,
    econf_set_delimiter_tag
  * Checking UID,GroupID, permissions,... of the parsed files (#165)
    New calls: econf_requireOwner, econf_requireGroup, econf_requirePermissions,
    econf_followSymlinks
  * Ignoring Group without brackets; Do not hold brackets in the internal data structure. (#164)
  * Error handling improved for nums and booleans (#163)</changelog>
  <changelog author="schubi@suse.com" date="1669204800">- Update to version 0.4.9:
  * libeconf.h: added missing sys/types.h header (#171)
  * new API calls: econf_readFileWithCallback,
    econf_readDirsWithCallback, econf_readDirsHistoryWithCallback (#172)
  * Checking NULL comment parameter in the parsing functions.</changelog>
  <changelog author="schubi@suse.com" date="1669982400">- Update to version 0.5.0:
  * API calls econf_read*WithCallback supporting a general (void *)
    argument for user defined data with which the callback function is
    called.
  * Tagged following functions deprecated:
    econf_requireOwner, econf_requireGroup, econf_requirePermissions,
    econf_followSymlinks, econf_reset_security_settings
    Use one of the econf_read*WithCallback functions instead.</changelog>
  <changelog author="schubi@suse.com" date="1674129600">- Update to version 0.5.1:
  * Reading files in /usr/_vendor_/_example_._suffix_.d/* regardless
    there is a /etc/_example_._suffix_ file. (#175)</changelog>
  <changelog author="schubi@suse.com" date="1679659200">- Update to version 0.5.2:
  * Fixed build for aarch64 and gcc13.
  * Making the output verbose when a test fails.
  * Fixed a stack-buffer-overflow vulnerability in "econf_writeFile"
    function.
  * Fixed a stack-buffer-overflow vulnerability in "read_file"
    function.
  * Added new feature: econf_set_conf_dirs (const char **dir_postfix_list)
    Sets a list of directory structures (with order) which describes
    the directories in which the files have to be parsed.
    E.G. with the given list: {"/conf.d/", ".d/", "/", NULL} files in following
    directories will be parsed:
    "&lt;default_dirs&gt;/&lt;project_name&gt;.&lt;suffix&gt;.d/"
    "&lt;default_dirs&gt;/&lt;project_name&gt;/conf.d/"
    "&lt;default_dirs&gt;/&lt;project_name&gt;.d/"
    "&lt;default_dirs&gt;/&lt;project_name&gt;/"
    The entry "&lt;default_dirs&gt;/&lt;project_name&gt;.&lt;suffix&gt;.d/" will be added
    automatically.
  * General code cleanup.</changelog>
  <changelog author="schubi@suse.com" date="1694001600">- Additional info for version 0.5.2:
  * Fixed a stack-buffer-overflow vulnerability in "econf_writeFile"
    function. (CVE-2023-30078, CVE-2023-32181, bsc#1211078)
  * Fixed a stack-buffer-overflow vulnerability in "read_file"
    function. (CVE-2023-30079, CVE-2023-22652, bsc#1211078)</changelog>
</package>
<package pkgid="e654a112184913261664490d7680499062916ae1789ae220c83e4421decade3f" name="libeconf0" arch="aarch64">
  <version epoch="0" ver="0.5.2" rel="150400.3.6.1"/>
  <changelog author="rbrown@suse.com" date="1594382400">- Update to version 0.3.8+git20200710.5126fff:
  * Add CMake build scripts, remove autotools support
  * Move C++ ABI compatibility section</changelog>
  <changelog author="lnussel@suse.de" date="1603368000">- explicitly BuildRequire: pkgconfig for /usr/lib/rpm/pkgconfigdeps.sh
  On TW it's pulled in implicitly by libxcrypt-devel which is not the
  case on 15.2</changelog>
  <changelog author="schubi@suse.com" date="1617883200">- Update to version 0.4.0+git20210408.6d33e5e:
  * Man pages libeconf.3 and econftool.8.
  * Handling multiline strings.
  * Added libeconf_ext which returns more information like
    line_nr, comments, path of the configuration file,...
  * Econftool, an command line interface for handling configuration
    files.
  * Generating HTML API documentation with doxygen.
  * Improving error handling and semantic file check.
  * Joining entries with the same key to one single entry if
    env variable ECONF_JOIN_SAME_ENTRIES has been set.</changelog>
  <changelog author="schubi@suse.com" date="1618228800">- Update to version 0.4.0+git20210412.1513a26:
  * Added econftool cat option (#146)
  * new API call: econf_readDirsHistory (showing ALL locations)
  * new API call: econf_getPath (absolute path of the configuration file)</changelog>
  <changelog author="schubi@suse.com" date="1618315200">- Update to version 0.4.0+git20210413.fdb8025:
  * Installing man pages via meson. (#147)</changelog>
  <changelog author="schubi@suse.com" date="1618488000">- Removed doxygen from build requires.</changelog>
  <changelog author="schubi@suse.com" date="1625659200">- Update to version 0.4.0+git20210707.537a8a:
  * Fixed resource leaks found by Iker Pedrosa.</changelog>
  <changelog author="Stefan Schubert schubi@suse.com" date="1625745600">- Update to version 0.4.0+git20210708.6918ea1:
  * Fixed covscan FORWARD_NULL_issues warnings</changelog>
  <changelog author="schubi@localhost" date="1625832000">- Update to version 0.4.1+git20210709.cf671f2:
  * CMake fixes regarding installation of econftool and man pages.</changelog>
  <changelog author="schubi@suse.com" date="1636632000">- Update to version libeconf-0.4.2+git20211111.c7a2c52:
  * CMake fixes regarding document installation.
  * Fixed different issues while writing string values to file.
  * Writing comments to file too.
  * Fixed memory leaks.
  * Fixed crash while merging values.</changelog>
  <changelog author="schubi@suse.com" date="1641297600">- Update to version 0.4.2+git20220104.5dfd69d:
  * Reading numbers with different bases (e.g. oktal) (bsc#1193632) (#157)</changelog>
  <changelog author="schubi@suse.com" date="1641297601">- Update to version 0.4.4+git20220104.962774f:
  * Fixed i586 build (#158)</changelog>
  <changelog author="schubi@suse.com" date="1649246400">- Update to version 0.4.5+git20220406.c9658f2:
  * econftool:
  * * New call "syntax" for checking the configuration files only.
    Returns an error string with line number if an error occurs.
  * * New options "--comment" and "--delimeters"
  * * Parsing one file only if needed.</changelog>
  <changelog author="schubi@suse.com" date="1651060800">- Update to version 0.4.6+git20220427.3016f4e:
  * econftool:
  * * Parsing error: Reporting file and line nr.
  * * --delimeters=spaces Taking all kind of spaces for delimiter
  * libeconf:
    Fixed bsc#1198165: Parsing files correctly which have space characters
    AND none space characters as delimiters.</changelog>
  <changelog author="schubi@suse.com" date="1668427200">- Update to version 0.4.8+git20221114.7ff7704:
  * Parsing files which are containing keys only (#170)
    All delimiters are allowed now : "", " =", " ", "=". But the
    user should use "" in order to be distinct.
  * /usr/etc/shells.d/&lt;file_name&gt; will not be parsed if
    /etc/shells.d/&lt;file_name&gt; is defined too.
  * Lto build fixed (#168)
  * New calls: econf_comment_tag, econf_delimiter_tag, econf_set_comment_tag,
    econf_set_delimiter_tag
  * Checking UID,GroupID, permissions,... of the parsed files (#165)
    New calls: econf_requireOwner, econf_requireGroup, econf_requirePermissions,
    econf_followSymlinks
  * Ignoring Group without brackets; Do not hold brackets in the internal data structure. (#164)
  * Error handling improved for nums and booleans (#163)</changelog>
  <changelog author="schubi@suse.com" date="1669204800">- Update to version 0.4.9:
  * libeconf.h: added missing sys/types.h header (#171)
  * new API calls: econf_readFileWithCallback,
    econf_readDirsWithCallback, econf_readDirsHistoryWithCallback (#172)
  * Checking NULL comment parameter in the parsing functions.</changelog>
  <changelog author="schubi@suse.com" date="1669982400">- Update to version 0.5.0:
  * API calls econf_read*WithCallback supporting a general (void *)
    argument for user defined data with which the callback function is
    called.
  * Tagged following functions deprecated:
    econf_requireOwner, econf_requireGroup, econf_requirePermissions,
    econf_followSymlinks, econf_reset_security_settings
    Use one of the econf_read*WithCallback functions instead.</changelog>
  <changelog author="schubi@suse.com" date="1674129600">- Update to version 0.5.1:
  * Reading files in /usr/_vendor_/_example_._suffix_.d/* regardless
    there is a /etc/_example_._suffix_ file. (#175)</changelog>
  <changelog author="schubi@suse.com" date="1679659200">- Update to version 0.5.2:
  * Fixed build for aarch64 and gcc13.
  * Making the output verbose when a test fails.
  * Fixed a stack-buffer-overflow vulnerability in "econf_writeFile"
    function.
  * Fixed a stack-buffer-overflow vulnerability in "read_file"
    function.
  * Added new feature: econf_set_conf_dirs (const char **dir_postfix_list)
    Sets a list of directory structures (with order) which describes
    the directories in which the files have to be parsed.
    E.G. with the given list: {"/conf.d/", ".d/", "/", NULL} files in following
    directories will be parsed:
    "&lt;default_dirs&gt;/&lt;project_name&gt;.&lt;suffix&gt;.d/"
    "&lt;default_dirs&gt;/&lt;project_name&gt;/conf.d/"
    "&lt;default_dirs&gt;/&lt;project_name&gt;.d/"
    "&lt;default_dirs&gt;/&lt;project_name&gt;/"
    The entry "&lt;default_dirs&gt;/&lt;project_name&gt;.&lt;suffix&gt;.d/" will be added
    automatically.
  * General code cleanup.</changelog>
  <changelog author="schubi@suse.com" date="1694001600">- Additional info for version 0.5.2:
  * Fixed a stack-buffer-overflow vulnerability in "econf_writeFile"
    function. (CVE-2023-30078, CVE-2023-32181, bsc#1211078)
  * Fixed a stack-buffer-overflow vulnerability in "read_file"
    function. (CVE-2023-30079, CVE-2023-22652, bsc#1211078)</changelog>
</package>
<package pkgid="66220754f9f0aeee71461bc89816488af2562458de36d35ae2eead0f8534128f" name="libeconf0" arch="s390x">
  <version epoch="0" ver="0.5.2" rel="150400.3.6.1"/>
  <changelog author="rbrown@suse.com" date="1594382400">- Update to version 0.3.8+git20200710.5126fff:
  * Add CMake build scripts, remove autotools support
  * Move C++ ABI compatibility section</changelog>
  <changelog author="lnussel@suse.de" date="1603368000">- explicitly BuildRequire: pkgconfig for /usr/lib/rpm/pkgconfigdeps.sh
  On TW it's pulled in implicitly by libxcrypt-devel which is not the
  case on 15.2</changelog>
  <changelog author="schubi@suse.com" date="1617883200">- Update to version 0.4.0+git20210408.6d33e5e:
  * Man pages libeconf.3 and econftool.8.
  * Handling multiline strings.
  * Added libeconf_ext which returns more information like
    line_nr, comments, path of the configuration file,...
  * Econftool, an command line interface for handling configuration
    files.
  * Generating HTML API documentation with doxygen.
  * Improving error handling and semantic file check.
  * Joining entries with the same key to one single entry if
    env variable ECONF_JOIN_SAME_ENTRIES has been set.</changelog>
  <changelog author="schubi@suse.com" date="1618228800">- Update to version 0.4.0+git20210412.1513a26:
  * Added econftool cat option (#146)
  * new API call: econf_readDirsHistory (showing ALL locations)
  * new API call: econf_getPath (absolute path of the configuration file)</changelog>
  <changelog author="schubi@suse.com" date="1618315200">- Update to version 0.4.0+git20210413.fdb8025:
  * Installing man pages via meson. (#147)</changelog>
  <changelog author="schubi@suse.com" date="1618488000">- Removed doxygen from build requires.</changelog>
  <changelog author="schubi@suse.com" date="1625659200">- Update to version 0.4.0+git20210707.537a8a:
  * Fixed resource leaks found by Iker Pedrosa.</changelog>
  <changelog author="Stefan Schubert schubi@suse.com" date="1625745600">- Update to version 0.4.0+git20210708.6918ea1:
  * Fixed covscan FORWARD_NULL_issues warnings</changelog>
  <changelog author="schubi@localhost" date="1625832000">- Update to version 0.4.1+git20210709.cf671f2:
  * CMake fixes regarding installation of econftool and man pages.</changelog>
  <changelog author="schubi@suse.com" date="1636632000">- Update to version libeconf-0.4.2+git20211111.c7a2c52:
  * CMake fixes regarding document installation.
  * Fixed different issues while writing string values to file.
  * Writing comments to file too.
  * Fixed memory leaks.
  * Fixed crash while merging values.</changelog>
  <changelog author="schubi@suse.com" date="1641297600">- Update to version 0.4.2+git20220104.5dfd69d:
  * Reading numbers with different bases (e.g. oktal) (bsc#1193632) (#157)</changelog>
  <changelog author="schubi@suse.com" date="1641297601">- Update to version 0.4.4+git20220104.962774f:
  * Fixed i586 build (#158)</changelog>
  <changelog author="schubi@suse.com" date="1649246400">- Update to version 0.4.5+git20220406.c9658f2:
  * econftool:
  * * New call "syntax" for checking the configuration files only.
    Returns an error string with line number if an error occurs.
  * * New options "--comment" and "--delimeters"
  * * Parsing one file only if needed.</changelog>
  <changelog author="schubi@suse.com" date="1651060800">- Update to version 0.4.6+git20220427.3016f4e:
  * econftool:
  * * Parsing error: Reporting file and line nr.
  * * --delimeters=spaces Taking all kind of spaces for delimiter
  * libeconf:
    Fixed bsc#1198165: Parsing files correctly which have space characters
    AND none space characters as delimiters.</changelog>
  <changelog author="schubi@suse.com" date="1668427200">- Update to version 0.4.8+git20221114.7ff7704:
  * Parsing files which are containing keys only (#170)
    All delimiters are allowed now : "", " =", " ", "=". But the
    user should use "" in order to be distinct.
  * /usr/etc/shells.d/&lt;file_name&gt; will not be parsed if
    /etc/shells.d/&lt;file_name&gt; is defined too.
  * Lto build fixed (#168)
  * New calls: econf_comment_tag, econf_delimiter_tag, econf_set_comment_tag,
    econf_set_delimiter_tag
  * Checking UID,GroupID, permissions,... of the parsed files (#165)
    New calls: econf_requireOwner, econf_requireGroup, econf_requirePermissions,
    econf_followSymlinks
  * Ignoring Group without brackets; Do not hold brackets in the internal data structure. (#164)
  * Error handling improved for nums and booleans (#163)</changelog>
  <changelog author="schubi@suse.com" date="1669204800">- Update to version 0.4.9:
  * libeconf.h: added missing sys/types.h header (#171)
  * new API calls: econf_readFileWithCallback,
    econf_readDirsWithCallback, econf_readDirsHistoryWithCallback (#172)
  * Checking NULL comment parameter in the parsing functions.</changelog>
  <changelog author="schubi@suse.com" date="1669982400">- Update to version 0.5.0:
  * API calls econf_read*WithCallback supporting a general (void *)
    argument for user defined data with which the callback function is
    called.
  * Tagged following functions deprecated:
    econf_requireOwner, econf_requireGroup, econf_requirePermissions,
    econf_followSymlinks, econf_reset_security_settings
    Use one of the econf_read*WithCallback functions instead.</changelog>
  <changelog author="schubi@suse.com" date="1674129600">- Update to version 0.5.1:
  * Reading files in /usr/_vendor_/_example_._suffix_.d/* regardless
    there is a /etc/_example_._suffix_ file. (#175)</changelog>
  <changelog author="schubi@suse.com" date="1679659200">- Update to version 0.5.2:
  * Fixed build for aarch64 and gcc13.
  * Making the output verbose when a test fails.
  * Fixed a stack-buffer-overflow vulnerability in "econf_writeFile"
    function.
  * Fixed a stack-buffer-overflow vulnerability in "read_file"
    function.
  * Added new feature: econf_set_conf_dirs (const char **dir_postfix_list)
    Sets a list of directory structures (with order) which describes
    the directories in which the files have to be parsed.
    E.G. with the given list: {"/conf.d/", ".d/", "/", NULL} files in following
    directories will be parsed:
    "&lt;default_dirs&gt;/&lt;project_name&gt;.&lt;suffix&gt;.d/"
    "&lt;default_dirs&gt;/&lt;project_name&gt;/conf.d/"
    "&lt;default_dirs&gt;/&lt;project_name&gt;.d/"
    "&lt;default_dirs&gt;/&lt;project_name&gt;/"
    The entry "&lt;default_dirs&gt;/&lt;project_name&gt;.&lt;suffix&gt;.d/" will be added
    automatically.
  * General code cleanup.</changelog>
  <changelog author="schubi@suse.com" date="1694001600">- Additional info for version 0.5.2:
  * Fixed a stack-buffer-overflow vulnerability in "econf_writeFile"
    function. (CVE-2023-30078, CVE-2023-32181, bsc#1211078)
  * Fixed a stack-buffer-overflow vulnerability in "read_file"
    function. (CVE-2023-30079, CVE-2023-22652, bsc#1211078)</changelog>
</package>
<package pkgid="f740e03a398e1a5684f32e385c61748d73e3f5e0c80627f9b24f3decf10d06cf" name="libeconf0" arch="x86_64">
  <version epoch="0" ver="0.5.2" rel="150400.3.6.1"/>
  <changelog author="rbrown@suse.com" date="1594382400">- Update to version 0.3.8+git20200710.5126fff:
  * Add CMake build scripts, remove autotools support
  * Move C++ ABI compatibility section</changelog>
  <changelog author="lnussel@suse.de" date="1603368000">- explicitly BuildRequire: pkgconfig for /usr/lib/rpm/pkgconfigdeps.sh
  On TW it's pulled in implicitly by libxcrypt-devel which is not the
  case on 15.2</changelog>
  <changelog author="schubi@suse.com" date="1617883200">- Update to version 0.4.0+git20210408.6d33e5e:
  * Man pages libeconf.3 and econftool.8.
  * Handling multiline strings.
  * Added libeconf_ext which returns more information like
    line_nr, comments, path of the configuration file,...
  * Econftool, an command line interface for handling configuration
    files.
  * Generating HTML API documentation with doxygen.
  * Improving error handling and semantic file check.
  * Joining entries with the same key to one single entry if
    env variable ECONF_JOIN_SAME_ENTRIES has been set.</changelog>
  <changelog author="schubi@suse.com" date="1618228800">- Update to version 0.4.0+git20210412.1513a26:
  * Added econftool cat option (#146)
  * new API call: econf_readDirsHistory (showing ALL locations)
  * new API call: econf_getPath (absolute path of the configuration file)</changelog>
  <changelog author="schubi@suse.com" date="1618315200">- Update to version 0.4.0+git20210413.fdb8025:
  * Installing man pages via meson. (#147)</changelog>
  <changelog author="schubi@suse.com" date="1618488000">- Removed doxygen from build requires.</changelog>
  <changelog author="schubi@suse.com" date="1625659200">- Update to version 0.4.0+git20210707.537a8a:
  * Fixed resource leaks found by Iker Pedrosa.</changelog>
  <changelog author="Stefan Schubert schubi@suse.com" date="1625745600">- Update to version 0.4.0+git20210708.6918ea1:
  * Fixed covscan FORWARD_NULL_issues warnings</changelog>
  <changelog author="schubi@localhost" date="1625832000">- Update to version 0.4.1+git20210709.cf671f2:
  * CMake fixes regarding installation of econftool and man pages.</changelog>
  <changelog author="schubi@suse.com" date="1636632000">- Update to version libeconf-0.4.2+git20211111.c7a2c52:
  * CMake fixes regarding document installation.
  * Fixed different issues while writing string values to file.
  * Writing comments to file too.
  * Fixed memory leaks.
  * Fixed crash while merging values.</changelog>
  <changelog author="schubi@suse.com" date="1641297600">- Update to version 0.4.2+git20220104.5dfd69d:
  * Reading numbers with different bases (e.g. oktal) (bsc#1193632) (#157)</changelog>
  <changelog author="schubi@suse.com" date="1641297601">- Update to version 0.4.4+git20220104.962774f:
  * Fixed i586 build (#158)</changelog>
  <changelog author="schubi@suse.com" date="1649246400">- Update to version 0.4.5+git20220406.c9658f2:
  * econftool:
  * * New call "syntax" for checking the configuration files only.
    Returns an error string with line number if an error occurs.
  * * New options "--comment" and "--delimeters"
  * * Parsing one file only if needed.</changelog>
  <changelog author="schubi@suse.com" date="1651060800">- Update to version 0.4.6+git20220427.3016f4e:
  * econftool:
  * * Parsing error: Reporting file and line nr.
  * * --delimeters=spaces Taking all kind of spaces for delimiter
  * libeconf:
    Fixed bsc#1198165: Parsing files correctly which have space characters
    AND none space characters as delimiters.</changelog>
  <changelog author="schubi@suse.com" date="1668427200">- Update to version 0.4.8+git20221114.7ff7704:
  * Parsing files which are containing keys only (#170)
    All delimiters are allowed now : "", " =", " ", "=". But the
    user should use "" in order to be distinct.
  * /usr/etc/shells.d/&lt;file_name&gt; will not be parsed if
    /etc/shells.d/&lt;file_name&gt; is defined too.
  * Lto build fixed (#168)
  * New calls: econf_comment_tag, econf_delimiter_tag, econf_set_comment_tag,
    econf_set_delimiter_tag
  * Checking UID,GroupID, permissions,... of the parsed files (#165)
    New calls: econf_requireOwner, econf_requireGroup, econf_requirePermissions,
    econf_followSymlinks
  * Ignoring Group without brackets; Do not hold brackets in the internal data structure. (#164)
  * Error handling improved for nums and booleans (#163)</changelog>
  <changelog author="schubi@suse.com" date="1669204800">- Update to version 0.4.9:
  * libeconf.h: added missing sys/types.h header (#171)
  * new API calls: econf_readFileWithCallback,
    econf_readDirsWithCallback, econf_readDirsHistoryWithCallback (#172)
  * Checking NULL comment parameter in the parsing functions.</changelog>
  <changelog author="schubi@suse.com" date="1669982400">- Update to version 0.5.0:
  * API calls econf_read*WithCallback supporting a general (void *)
    argument for user defined data with which the callback function is
    called.
  * Tagged following functions deprecated:
    econf_requireOwner, econf_requireGroup, econf_requirePermissions,
    econf_followSymlinks, econf_reset_security_settings
    Use one of the econf_read*WithCallback functions instead.</changelog>
  <changelog author="schubi@suse.com" date="1674129600">- Update to version 0.5.1:
  * Reading files in /usr/_vendor_/_example_._suffix_.d/* regardless
    there is a /etc/_example_._suffix_ file. (#175)</changelog>
  <changelog author="schubi@suse.com" date="1679659200">- Update to version 0.5.2:
  * Fixed build for aarch64 and gcc13.
  * Making the output verbose when a test fails.
  * Fixed a stack-buffer-overflow vulnerability in "econf_writeFile"
    function.
  * Fixed a stack-buffer-overflow vulnerability in "read_file"
    function.
  * Added new feature: econf_set_conf_dirs (const char **dir_postfix_list)
    Sets a list of directory structures (with order) which describes
    the directories in which the files have to be parsed.
    E.G. with the given list: {"/conf.d/", ".d/", "/", NULL} files in following
    directories will be parsed:
    "&lt;default_dirs&gt;/&lt;project_name&gt;.&lt;suffix&gt;.d/"
    "&lt;default_dirs&gt;/&lt;project_name&gt;/conf.d/"
    "&lt;default_dirs&gt;/&lt;project_name&gt;.d/"
    "&lt;default_dirs&gt;/&lt;project_name&gt;/"
    The entry "&lt;default_dirs&gt;/&lt;project_name&gt;.&lt;suffix&gt;.d/" will be added
    automatically.
  * General code cleanup.</changelog>
  <changelog author="schubi@suse.com" date="1694001600">- Additional info for version 0.5.2:
  * Fixed a stack-buffer-overflow vulnerability in "econf_writeFile"
    function. (CVE-2023-30078, CVE-2023-32181, bsc#1211078)
  * Fixed a stack-buffer-overflow vulnerability in "read_file"
    function. (CVE-2023-30079, CVE-2023-22652, bsc#1211078)</changelog>
</package>
<package pkgid="306cbfaede71db3d1fa6e519253f52f5f5c0128bacb3d227fbb9af45644cf2b4" name="libgcc_s1" arch="aarch64">
  <version epoch="0" ver="13.2.1+git7813" rel="150000.1.3.3"/>
  <changelog author="mliska@suse.cz" date="1679659200">- Use --enable-link-serialization rather that --enable-link-mutex,
  the benefit of the former one is that the linker jobs are not
  holding tokens of the make's jobserver.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1679659201">- Add %limit_build for gcc13 to avoid OOM</changelog>
  <changelog author="mliska@suse.cz" date="1680609600">- Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995.</changelog>
  <changelog author="schwab@suse.de" date="1681214400">- riscv-atomic.patch: RISC-V: Add support for inlining subword atomic
  operations
- riscv-pthread.patch: Don't add -latomic with -pthread</changelog>
  <changelog author="mliska@suse.cz" date="1681214401">- Add new x86-related intrinsics (amxcomplexintrin.h).</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162.</changelog>
  <changelog author="rguenther@suse.com" date="1682078400">- Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231.
  * fixes compile-time issue reported in [bsc#1210557]
  * GCC 13.1 RC3
- Disable building the rust frontend.</changelog>
  <changelog author="rguenther@suse.com" date="1682596800">- Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256.
  * Includes GCC 13.1 release and first bugfixes
- Update riscv-atomic.patch from the version committed upstream.</changelog>
  <changelog author="rguenther@suse.com" date="1684756800">- Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364.
  * Includes the RISC-V atomic changes
- Remove riscv-atomic.patch and riscv-pthread.patch now included
- Make libstdc++6-devel packages own their directories since they
  can be installed standalone.  [bsc#1211427]</changelog>
  <changelog author="rguenther@suse.com" date="1686657600">- Raise architecture levels for ALP.  [PED-153]
  * Raise POWER architecture baseline to power9.  [PED-2005]
  * Raise x86-64 architecture baseline to x86-64-v2 for ALP.  [PED-252]
  * Delay raising s390x architecture baseline to z14.  [PED-253]</changelog>
  <changelog author="rguenther@suse.com" date="1687953600">- Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489.
- Add gcc13-pr110334.patch to fix missed optimization in Skia
  resulting in Firefox crashes when building with LTO.  [boo#1212101]</changelog>
  <changelog author="rguenther@suse.com" date="1688990400">- Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552
- Remove gcc13-pr110334.patch again as it breaks libreoffice build.</changelog>
  <changelog author="schwab@suse.de" date="1689076800">- Also handle -static-pie in the default-PIE specs</changelog>
  <changelog author="rguenther@suse.com" date="1689854400">- Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597
  * GCC 13.2 RC1
- Add rpmlint filter for SLE12 complaining about invalid licenses.</changelog>
  <changelog author="schwab@suse.de" date="1690977600">- gdcflags.patch: Use substituted GDCFLAGS
- Filter out -Werror=return-type from D compile flags</changelog>
  <changelog author="rguenther@suse.com" date="1691064000">- Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683
  * Includes GCC 13.2 release
  * Includes patch to fix broken testcase in libbacktrace, fixing
    build problems on SLES 12</changelog>
  <changelog author="msuchanek@suse.com" date="1692360000">- Raise Power architecture baseline to Power9 only for ALP (boo#1213915).</changelog>
  <changelog author="rguenther@suse.com" date="1692792000">- Turn cross compiler to s390x to a glibc cross.  [bsc#1214460]</changelog>
  <changelog author="rguenther@suse.com" date="1693224000">- Disable building glibc cross compilers on SLE based code streams,
  the required cross-glibc packages are not available there.
- Disable building avr cross on non-openSUSE code streams since
  avr-libc isn't available there.
- Disable building newlib cross compilers on non-openSUSE code streams
  since newlib isn't available there.
- Fix typo preventing s390x compiler build.
- Raise s390x architecture baseline to z14 for ALP.  [PED-253]
- Turn cross compiler to ppc64le to a glibc cross.</changelog>
  <changelog author="rguenther@suse.com" date="1694520000">- Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831
  * Includes many bugfixes
  * Includes fix to -fstack-protector issues with variable
    length stack allocations on aarch64.  [bsc#1214052] (CVE-2023-4039)</changelog>
</package>
<package pkgid="2abf1900bcf0f09242833eb5b1700d90632148464e915f7dbb8c0c9a39c908a1" name="libgcc_s1" arch="s390x">
  <version epoch="0" ver="13.2.1+git7813" rel="150000.1.3.3"/>
  <changelog author="mliska@suse.cz" date="1679659200">- Use --enable-link-serialization rather that --enable-link-mutex,
  the benefit of the former one is that the linker jobs are not
  holding tokens of the make's jobserver.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1679659201">- Add %limit_build for gcc13 to avoid OOM</changelog>
  <changelog author="mliska@suse.cz" date="1680609600">- Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995.</changelog>
  <changelog author="schwab@suse.de" date="1681214400">- riscv-atomic.patch: RISC-V: Add support for inlining subword atomic
  operations
- riscv-pthread.patch: Don't add -latomic with -pthread</changelog>
  <changelog author="mliska@suse.cz" date="1681214401">- Add new x86-related intrinsics (amxcomplexintrin.h).</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162.</changelog>
  <changelog author="rguenther@suse.com" date="1682078400">- Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231.
  * fixes compile-time issue reported in [bsc#1210557]
  * GCC 13.1 RC3
- Disable building the rust frontend.</changelog>
  <changelog author="rguenther@suse.com" date="1682596800">- Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256.
  * Includes GCC 13.1 release and first bugfixes
- Update riscv-atomic.patch from the version committed upstream.</changelog>
  <changelog author="rguenther@suse.com" date="1684756800">- Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364.
  * Includes the RISC-V atomic changes
- Remove riscv-atomic.patch and riscv-pthread.patch now included
- Make libstdc++6-devel packages own their directories since they
  can be installed standalone.  [bsc#1211427]</changelog>
  <changelog author="rguenther@suse.com" date="1686657600">- Raise architecture levels for ALP.  [PED-153]
  * Raise POWER architecture baseline to power9.  [PED-2005]
  * Raise x86-64 architecture baseline to x86-64-v2 for ALP.  [PED-252]
  * Delay raising s390x architecture baseline to z14.  [PED-253]</changelog>
  <changelog author="rguenther@suse.com" date="1687953600">- Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489.
- Add gcc13-pr110334.patch to fix missed optimization in Skia
  resulting in Firefox crashes when building with LTO.  [boo#1212101]</changelog>
  <changelog author="rguenther@suse.com" date="1688990400">- Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552
- Remove gcc13-pr110334.patch again as it breaks libreoffice build.</changelog>
  <changelog author="schwab@suse.de" date="1689076800">- Also handle -static-pie in the default-PIE specs</changelog>
  <changelog author="rguenther@suse.com" date="1689854400">- Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597
  * GCC 13.2 RC1
- Add rpmlint filter for SLE12 complaining about invalid licenses.</changelog>
  <changelog author="schwab@suse.de" date="1690977600">- gdcflags.patch: Use substituted GDCFLAGS
- Filter out -Werror=return-type from D compile flags</changelog>
  <changelog author="rguenther@suse.com" date="1691064000">- Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683
  * Includes GCC 13.2 release
  * Includes patch to fix broken testcase in libbacktrace, fixing
    build problems on SLES 12</changelog>
  <changelog author="msuchanek@suse.com" date="1692360000">- Raise Power architecture baseline to Power9 only for ALP (boo#1213915).</changelog>
  <changelog author="rguenther@suse.com" date="1692792000">- Turn cross compiler to s390x to a glibc cross.  [bsc#1214460]</changelog>
  <changelog author="rguenther@suse.com" date="1693224000">- Disable building glibc cross compilers on SLE based code streams,
  the required cross-glibc packages are not available there.
- Disable building avr cross on non-openSUSE code streams since
  avr-libc isn't available there.
- Disable building newlib cross compilers on non-openSUSE code streams
  since newlib isn't available there.
- Fix typo preventing s390x compiler build.
- Raise s390x architecture baseline to z14 for ALP.  [PED-253]
- Turn cross compiler to ppc64le to a glibc cross.</changelog>
  <changelog author="rguenther@suse.com" date="1694520000">- Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831
  * Includes many bugfixes
  * Includes fix to -fstack-protector issues with variable
    length stack allocations on aarch64.  [bsc#1214052] (CVE-2023-4039)</changelog>
</package>
<package pkgid="3b5b525e46b769487d743fac4988e8490749360dab266f3f43178d3341d7bf5a" name="libgcc_s1" arch="x86_64">
  <version epoch="0" ver="13.2.1+git7813" rel="150000.1.3.3"/>
  <changelog author="mliska@suse.cz" date="1679659200">- Use --enable-link-serialization rather that --enable-link-mutex,
  the benefit of the former one is that the linker jobs are not
  holding tokens of the make's jobserver.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1679659201">- Add %limit_build for gcc13 to avoid OOM</changelog>
  <changelog author="mliska@suse.cz" date="1680609600">- Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995.</changelog>
  <changelog author="schwab@suse.de" date="1681214400">- riscv-atomic.patch: RISC-V: Add support for inlining subword atomic
  operations
- riscv-pthread.patch: Don't add -latomic with -pthread</changelog>
  <changelog author="mliska@suse.cz" date="1681214401">- Add new x86-related intrinsics (amxcomplexintrin.h).</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162.</changelog>
  <changelog author="rguenther@suse.com" date="1682078400">- Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231.
  * fixes compile-time issue reported in [bsc#1210557]
  * GCC 13.1 RC3
- Disable building the rust frontend.</changelog>
  <changelog author="rguenther@suse.com" date="1682596800">- Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256.
  * Includes GCC 13.1 release and first bugfixes
- Update riscv-atomic.patch from the version committed upstream.</changelog>
  <changelog author="rguenther@suse.com" date="1684756800">- Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364.
  * Includes the RISC-V atomic changes
- Remove riscv-atomic.patch and riscv-pthread.patch now included
- Make libstdc++6-devel packages own their directories since they
  can be installed standalone.  [bsc#1211427]</changelog>
  <changelog author="rguenther@suse.com" date="1686657600">- Raise architecture levels for ALP.  [PED-153]
  * Raise POWER architecture baseline to power9.  [PED-2005]
  * Raise x86-64 architecture baseline to x86-64-v2 for ALP.  [PED-252]
  * Delay raising s390x architecture baseline to z14.  [PED-253]</changelog>
  <changelog author="rguenther@suse.com" date="1687953600">- Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489.
- Add gcc13-pr110334.patch to fix missed optimization in Skia
  resulting in Firefox crashes when building with LTO.  [boo#1212101]</changelog>
  <changelog author="rguenther@suse.com" date="1688990400">- Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552
- Remove gcc13-pr110334.patch again as it breaks libreoffice build.</changelog>
  <changelog author="schwab@suse.de" date="1689076800">- Also handle -static-pie in the default-PIE specs</changelog>
  <changelog author="rguenther@suse.com" date="1689854400">- Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597
  * GCC 13.2 RC1
- Add rpmlint filter for SLE12 complaining about invalid licenses.</changelog>
  <changelog author="schwab@suse.de" date="1690977600">- gdcflags.patch: Use substituted GDCFLAGS
- Filter out -Werror=return-type from D compile flags</changelog>
  <changelog author="rguenther@suse.com" date="1691064000">- Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683
  * Includes GCC 13.2 release
  * Includes patch to fix broken testcase in libbacktrace, fixing
    build problems on SLES 12</changelog>
  <changelog author="msuchanek@suse.com" date="1692360000">- Raise Power architecture baseline to Power9 only for ALP (boo#1213915).</changelog>
  <changelog author="rguenther@suse.com" date="1692792000">- Turn cross compiler to s390x to a glibc cross.  [bsc#1214460]</changelog>
  <changelog author="rguenther@suse.com" date="1693224000">- Disable building glibc cross compilers on SLE based code streams,
  the required cross-glibc packages are not available there.
- Disable building avr cross on non-openSUSE code streams since
  avr-libc isn't available there.
- Disable building newlib cross compilers on non-openSUSE code streams
  since newlib isn't available there.
- Fix typo preventing s390x compiler build.
- Raise s390x architecture baseline to z14 for ALP.  [PED-253]
- Turn cross compiler to ppc64le to a glibc cross.</changelog>
  <changelog author="rguenther@suse.com" date="1694520000">- Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831
  * Includes many bugfixes
  * Includes fix to -fstack-protector issues with variable
    length stack allocations on aarch64.  [bsc#1214052] (CVE-2023-4039)</changelog>
</package>
<package pkgid="e0f541a34dff7151c898bee0ec596adc89c0422a9d61761baea33b1c2940d1ec" name="libguestfs" arch="src">
  <version epoch="0" ver="1.48.6" rel="150500.3.8.1"/>
  <changelog author="carnold@suse.com" date="1635249600">- Fix build errors in Factory
  * Alert ocaml_deprecated_cli: Setting a warning with a sequence
    of lowercase or uppercase letters, like 'CDEFLMPSUVYZX', is
    deprecated.
  63c9cd93-m4-guestfs-ocaml.m4-Fix-deprecated-warning-format.patch
  * Error (warning 6 [labels-omitted]): label verbose was omitted
    in the application of this function.
  a4930f5f-customize-Suppress-OCaml-warning.patch</changelog>
  <changelog author="ohering@suse.de" date="1639483200">- Add python-rpm-macros (bsc#1180125)</changelog>
  <changelog author="carnold@suse.com" date="1644235200">- bsc#1195415 - libguestfs: consider dropping build requirement on
  systemd-sysvinit
  libguestfs.spec</changelog>
  <changelog author="carnold@suse.com" date="1645012800">- Update to version 1.46.2
  * This release has moved many virt tools like virt-builder,
    virt-cat, virt-customize, virt-df, etc. to the guestfs-tools
    project. This makes libguestfs a bit easier to build and manage.
  * The build now uses and requires PCRE2 (instead of PCRE).
  * This version requires libvirt ≥ 7.1.0, if libvirt is enabled.
  * gnulib is no longer bundled with libguestfs, making builds from
    git much simpler.
  * Perl Sys::Virt (libvirt bindings for Perl) are no longer
    required by libguestfs.
  * The code has been compiled with both LTO and GCC -fanalyzer and
    many bugs and warnings fixed.
  * Various fixes for qemu 6.1.
  * Update appliance packages on SUSE and several other improvements
    to the init script (Olaf Hering).
  * We now use the qemu / libvirt feature -cpu max to select the
    best CPU to run the appliance.
  * When passing the appliance filesystem UUID to supermin we now
    read it directly out of the appliance instead of using the
    file(1) program. This is more reliable.
  * The qemu -enable-fips option is no longer used. It was not
    needed and has been deprecated by qemu.
  * We no longer use qemu's sga (Serial Graphics Adapter) option
    ROM, instead using the equivalent seabios feature.
  * Various bug fixes
- Package changes
  * New libguestfs.spec file.
  * Moved guestfs-tools to a new and separate project and package
  * Renamed packages
    guestfs-winsupport -&gt; libguestfs-winsupport
    guestfsd -&gt; libguestfsd
  * New packages
    libguestfs, libguestfs-typelib-Guestfs,
    libguestfs-gobject, libguestfs-gobject-devel
    libguestfs-rescue, libguestfs-rsync, libguestfs-xfs
  * Dropped package libguestfs-test
- Dropped scripts and patches
  Pod-Simple-3.23.tar.xz
  libguestfs.test.simple.create-opensuse-guest-crypt-on-lvm.sh
  libguestfs.test.simple.create-opensuse-guest.sh
  libguestfs.test.simple.create-sles12-guest-crypt-on-lvm.sh
  libguestfs.test.simple.create-sles12-guest.sh
  libguestfs.test.simple.run-libugestfs-test-tool.sh
  0001-Introduce-a-wrapper-around-xmlParseURI.patch
  0002-common-extract-UTF-8-conversion-function.patch
  0003-inspector-rpm-summary-and-description-may-not-be-utf.patch
  489b14b7-ocaml-examples-Link-examples-to-gnulib.patch
  63c9cd93-m4-guestfs-ocaml.m4-Fix-deprecated-warning-format.patch
  68a02c2f-customize--resize--sparsify--sysprep-Link-explicitly-with-pthread.patch
  9db0c98c-appliance-enable-bashs-Process-Substitution-feature.patch
  a4930f5f-customize-Suppress-OCaml-warning.patch
  c0de4de9-appliance-add-reboot-and-netconfig-for-SUSE.patch
  e26cfa44-daemon-Build-with--pthread.patch
  f47e0bb6-appliance-reorder-mounting-of-special-filesystems-in-init.patch
  appliance.patch
  libguestfs.env.patch
  makefile-ocaml-find-guestfs.patch
  netconfig.patch</changelog>
  <changelog author="carnold@suse.com" date="1647518400">- Update to version 1.48.0
  * Fix allocation and deallocation of string lists in golang
    bindings (Laszlo Ersek).
  * Multiple fixes to the OCaml bindings:
  * Add support for Kylin (Laszlo Ersek).
  * Add support for Rocky Linux (Neil Hanlon).
  * Inspection of guests which use LUKS encryption on top of LVM
    logical volumes should now work (Laszlo Ersek).
  * "guestfs_list_9p" and "guestfs_mount_9p" are deprecated and
    now return errors.
  * "guestfs_remove_drive" has been deprecated and now returns an
    error.
  * "guestfs_add_drive" no longer supports hotplugging
  * In "guestfs_xfs_admin" the "lazycounter" parameter is deprecated
    because it is no longer supported in recent versions of XFS.
  * The User-mode Linux ("uml") backend has been removed.
  * Partition APIs now cope with the broken MBR partition tables
    created by dosfstools ≥ 4.2 (Laszlo Ersek).
  * Various bug fixes</changelog>
  <changelog author="hpj@urpla.net" date="1649851200">- Avoid useless builds, if ocaml version isn't up to the task
  libguestfs uses get_uint8(), available since ocaml 4.13.0</changelog>
  <changelog author="hpj@urpla.net" date="1649851201">- Add relevant %post{,un} sections
- Add another rpmlint filter
- Add uk man dirs</changelog>
  <changelog author="carnold@suse.com" date="1650283200">- Update to version 1.48.1
  * Updated language files
  * A few bug fixes in this release
  * Drop requirement for newer ocaml required by Bytes.get_uint8.
    It is replaced with a local implementation.</changelog>
  <changelog author="carnold@suse.com" date="1654084800">- Update to version 1.48.3
  * Several bugs fixed in this release since version 1.48.1
  * Updated language files</changelog>
  <changelog author="carnold@suse.com" date="1654257600">- bsc#1190501 - virt-builder fails to install packages when
  building an image. Add Recommends: dhcp-client for the appliance.
  libguestfs.spec</changelog>
  <changelog author="carnold@suse.com" date="1656504000">- bsc#1201064 - Libguestfs: Buffer overflow in get_keys leads
  to DOS - CVE-2022-2211
  CVE-2022-2211-options-fix-buffer-overflow-in-get_keys.patch
  CVE-2022-2211-docs-guestfs-security-document.patch</changelog>
  <changelog author="carnold@suse.com" date="1657627200">- Update to version 1.48.4
  * This is a bug fix release
- Drop patches included in new tarball
  CVE-2022-2211-docs-guestfs-security-document.patch
  CVE-2022-2211-options-fix-buffer-overflow-in-get_keys.patch</changelog>
  <changelog author="carnold@suse.com" date="1662465600">- Upstream patch to fix running configure --disable-ocaml
  f162e47e-m4-Fix-configure-disable-ocaml.patch</changelog>
  <changelog author="carnold@suse.com" date="1664884800">- jsc#PED-2113 [Virt Tools] Refresh Virtualization Tools for Xen
  and KVM Management</changelog>
  <changelog author="carnold@suse.com" date="1665748800">- Drop requirement for icoutils in SLE as this package is not
  available.
  libguestfs.spec</changelog>
  <changelog author="lnussel@suse.de" date="1666267200">- Drop reiserfs (boo#1191092)</changelog>
  <changelog author="carnold@suse.com" date="1669723200">- Update to version 1.48.6
  * jsc#PED-2113
  * This is a bug fix release. No upstream changelog.
- Drop f162e47e-m4-Fix-configure-disable-ocaml.patch</changelog>
  <changelog author="carnold@suse.com" date="1688558400">- bsc#1212972 - cannot find any suitable libguestfs supermin
  libguestfs.spec (see also bsc#1215664)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1688990400">- bsc#1213243 - KubeVirt needs libguestfs with the support of qcow2
  appliances
  Configure with --enable-appliance-format-auto to allow
  qcow2-format fixed appliances.
  libguestfs.spec</changelog>
  <changelog author="carnold@suse.com" date="1695643200">- bsc#1215543 - guestfs regression: file: Use -S option with -z
  Omit-file--S-option-on-older-distros-that-lack-support.patch
  See also bsc#1215461
- bsc#1215586 - guestfs regression: non functional network due to
  missing sysconfig-netconfig
  libguestfs.spec</changelog>
</package>
<package pkgid="2124df8c3697f953d306f5f462f5e78bef3ade11efede09853a426a9db83aa1b" name="libguestfs0" arch="aarch64">
  <version epoch="0" ver="1.48.6" rel="150500.3.8.1"/>
  <changelog author="carnold@suse.com" date="1635249600">- Fix build errors in Factory
  * Alert ocaml_deprecated_cli: Setting a warning with a sequence
    of lowercase or uppercase letters, like 'CDEFLMPSUVYZX', is
    deprecated.
  63c9cd93-m4-guestfs-ocaml.m4-Fix-deprecated-warning-format.patch
  * Error (warning 6 [labels-omitted]): label verbose was omitted
    in the application of this function.
  a4930f5f-customize-Suppress-OCaml-warning.patch</changelog>
  <changelog author="ohering@suse.de" date="1639483200">- Add python-rpm-macros (bsc#1180125)</changelog>
  <changelog author="carnold@suse.com" date="1644235200">- bsc#1195415 - libguestfs: consider dropping build requirement on
  systemd-sysvinit
  libguestfs.spec</changelog>
  <changelog author="carnold@suse.com" date="1645012800">- Update to version 1.46.2
  * This release has moved many virt tools like virt-builder,
    virt-cat, virt-customize, virt-df, etc. to the guestfs-tools
    project. This makes libguestfs a bit easier to build and manage.
  * The build now uses and requires PCRE2 (instead of PCRE).
  * This version requires libvirt ≥ 7.1.0, if libvirt is enabled.
  * gnulib is no longer bundled with libguestfs, making builds from
    git much simpler.
  * Perl Sys::Virt (libvirt bindings for Perl) are no longer
    required by libguestfs.
  * The code has been compiled with both LTO and GCC -fanalyzer and
    many bugs and warnings fixed.
  * Various fixes for qemu 6.1.
  * Update appliance packages on SUSE and several other improvements
    to the init script (Olaf Hering).
  * We now use the qemu / libvirt feature -cpu max to select the
    best CPU to run the appliance.
  * When passing the appliance filesystem UUID to supermin we now
    read it directly out of the appliance instead of using the
    file(1) program. This is more reliable.
  * The qemu -enable-fips option is no longer used. It was not
    needed and has been deprecated by qemu.
  * We no longer use qemu's sga (Serial Graphics Adapter) option
    ROM, instead using the equivalent seabios feature.
  * Various bug fixes
- Package changes
  * New libguestfs.spec file.
  * Moved guestfs-tools to a new and separate project and package
  * Renamed packages
    guestfs-winsupport -&gt; libguestfs-winsupport
    guestfsd -&gt; libguestfsd
  * New packages
    libguestfs, libguestfs-typelib-Guestfs,
    libguestfs-gobject, libguestfs-gobject-devel
    libguestfs-rescue, libguestfs-rsync, libguestfs-xfs
  * Dropped package libguestfs-test
- Dropped scripts and patches
  Pod-Simple-3.23.tar.xz
  libguestfs.test.simple.create-opensuse-guest-crypt-on-lvm.sh
  libguestfs.test.simple.create-opensuse-guest.sh
  libguestfs.test.simple.create-sles12-guest-crypt-on-lvm.sh
  libguestfs.test.simple.create-sles12-guest.sh
  libguestfs.test.simple.run-libugestfs-test-tool.sh
  0001-Introduce-a-wrapper-around-xmlParseURI.patch
  0002-common-extract-UTF-8-conversion-function.patch
  0003-inspector-rpm-summary-and-description-may-not-be-utf.patch
  489b14b7-ocaml-examples-Link-examples-to-gnulib.patch
  63c9cd93-m4-guestfs-ocaml.m4-Fix-deprecated-warning-format.patch
  68a02c2f-customize--resize--sparsify--sysprep-Link-explicitly-with-pthread.patch
  9db0c98c-appliance-enable-bashs-Process-Substitution-feature.patch
  a4930f5f-customize-Suppress-OCaml-warning.patch
  c0de4de9-appliance-add-reboot-and-netconfig-for-SUSE.patch
  e26cfa44-daemon-Build-with--pthread.patch
  f47e0bb6-appliance-reorder-mounting-of-special-filesystems-in-init.patch
  appliance.patch
  libguestfs.env.patch
  makefile-ocaml-find-guestfs.patch
  netconfig.patch</changelog>
  <changelog author="carnold@suse.com" date="1647518400">- Update to version 1.48.0
  * Fix allocation and deallocation of string lists in golang
    bindings (Laszlo Ersek).
  * Multiple fixes to the OCaml bindings:
  * Add support for Kylin (Laszlo Ersek).
  * Add support for Rocky Linux (Neil Hanlon).
  * Inspection of guests which use LUKS encryption on top of LVM
    logical volumes should now work (Laszlo Ersek).
  * "guestfs_list_9p" and "guestfs_mount_9p" are deprecated and
    now return errors.
  * "guestfs_remove_drive" has been deprecated and now returns an
    error.
  * "guestfs_add_drive" no longer supports hotplugging
  * In "guestfs_xfs_admin" the "lazycounter" parameter is deprecated
    because it is no longer supported in recent versions of XFS.
  * The User-mode Linux ("uml") backend has been removed.
  * Partition APIs now cope with the broken MBR partition tables
    created by dosfstools ≥ 4.2 (Laszlo Ersek).
  * Various bug fixes</changelog>
  <changelog author="hpj@urpla.net" date="1649851200">- Avoid useless builds, if ocaml version isn't up to the task
  libguestfs uses get_uint8(), available since ocaml 4.13.0</changelog>
  <changelog author="hpj@urpla.net" date="1649851201">- Add relevant %post{,un} sections
- Add another rpmlint filter
- Add uk man dirs</changelog>
  <changelog author="carnold@suse.com" date="1650283200">- Update to version 1.48.1
  * Updated language files
  * A few bug fixes in this release
  * Drop requirement for newer ocaml required by Bytes.get_uint8.
    It is replaced with a local implementation.</changelog>
  <changelog author="carnold@suse.com" date="1654084800">- Update to version 1.48.3
  * Several bugs fixed in this release since version 1.48.1
  * Updated language files</changelog>
  <changelog author="carnold@suse.com" date="1654257600">- bsc#1190501 - virt-builder fails to install packages when
  building an image. Add Recommends: dhcp-client for the appliance.
  libguestfs.spec</changelog>
  <changelog author="carnold@suse.com" date="1656504000">- bsc#1201064 - Libguestfs: Buffer overflow in get_keys leads
  to DOS - CVE-2022-2211
  CVE-2022-2211-options-fix-buffer-overflow-in-get_keys.patch
  CVE-2022-2211-docs-guestfs-security-document.patch</changelog>
  <changelog author="carnold@suse.com" date="1657627200">- Update to version 1.48.4
  * This is a bug fix release
- Drop patches included in new tarball
  CVE-2022-2211-docs-guestfs-security-document.patch
  CVE-2022-2211-options-fix-buffer-overflow-in-get_keys.patch</changelog>
  <changelog author="carnold@suse.com" date="1662465600">- Upstream patch to fix running configure --disable-ocaml
  f162e47e-m4-Fix-configure-disable-ocaml.patch</changelog>
  <changelog author="carnold@suse.com" date="1664884800">- jsc#PED-2113 [Virt Tools] Refresh Virtualization Tools for Xen
  and KVM Management</changelog>
  <changelog author="carnold@suse.com" date="1665748800">- Drop requirement for icoutils in SLE as this package is not
  available.
  libguestfs.spec</changelog>
  <changelog author="lnussel@suse.de" date="1666267200">- Drop reiserfs (boo#1191092)</changelog>
  <changelog author="carnold@suse.com" date="1669723200">- Update to version 1.48.6
  * jsc#PED-2113
  * This is a bug fix release. No upstream changelog.
- Drop f162e47e-m4-Fix-configure-disable-ocaml.patch</changelog>
  <changelog author="carnold@suse.com" date="1688558400">- bsc#1212972 - cannot find any suitable libguestfs supermin
  libguestfs.spec (see also bsc#1215664)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1688990400">- bsc#1213243 - KubeVirt needs libguestfs with the support of qcow2
  appliances
  Configure with --enable-appliance-format-auto to allow
  qcow2-format fixed appliances.
  libguestfs.spec</changelog>
  <changelog author="carnold@suse.com" date="1695643200">- bsc#1215543 - guestfs regression: file: Use -S option with -z
  Omit-file--S-option-on-older-distros-that-lack-support.patch
  See also bsc#1215461
- bsc#1215586 - guestfs regression: non functional network due to
  missing sysconfig-netconfig
  libguestfs.spec</changelog>
</package>
<package pkgid="53332cb126f631eacea1081d62a97e991fc3d316638cb8bc3230484f30a6a40e" name="libguestfs0" arch="s390x">
  <version epoch="0" ver="1.48.6" rel="150500.3.8.1"/>
  <changelog author="carnold@suse.com" date="1635249600">- Fix build errors in Factory
  * Alert ocaml_deprecated_cli: Setting a warning with a sequence
    of lowercase or uppercase letters, like 'CDEFLMPSUVYZX', is
    deprecated.
  63c9cd93-m4-guestfs-ocaml.m4-Fix-deprecated-warning-format.patch
  * Error (warning 6 [labels-omitted]): label verbose was omitted
    in the application of this function.
  a4930f5f-customize-Suppress-OCaml-warning.patch</changelog>
  <changelog author="ohering@suse.de" date="1639483200">- Add python-rpm-macros (bsc#1180125)</changelog>
  <changelog author="carnold@suse.com" date="1644235200">- bsc#1195415 - libguestfs: consider dropping build requirement on
  systemd-sysvinit
  libguestfs.spec</changelog>
  <changelog author="carnold@suse.com" date="1645012800">- Update to version 1.46.2
  * This release has moved many virt tools like virt-builder,
    virt-cat, virt-customize, virt-df, etc. to the guestfs-tools
    project. This makes libguestfs a bit easier to build and manage.
  * The build now uses and requires PCRE2 (instead of PCRE).
  * This version requires libvirt ≥ 7.1.0, if libvirt is enabled.
  * gnulib is no longer bundled with libguestfs, making builds from
    git much simpler.
  * Perl Sys::Virt (libvirt bindings for Perl) are no longer
    required by libguestfs.
  * The code has been compiled with both LTO and GCC -fanalyzer and
    many bugs and warnings fixed.
  * Various fixes for qemu 6.1.
  * Update appliance packages on SUSE and several other improvements
    to the init script (Olaf Hering).
  * We now use the qemu / libvirt feature -cpu max to select the
    best CPU to run the appliance.
  * When passing the appliance filesystem UUID to supermin we now
    read it directly out of the appliance instead of using the
    file(1) program. This is more reliable.
  * The qemu -enable-fips option is no longer used. It was not
    needed and has been deprecated by qemu.
  * We no longer use qemu's sga (Serial Graphics Adapter) option
    ROM, instead using the equivalent seabios feature.
  * Various bug fixes
- Package changes
  * New libguestfs.spec file.
  * Moved guestfs-tools to a new and separate project and package
  * Renamed packages
    guestfs-winsupport -&gt; libguestfs-winsupport
    guestfsd -&gt; libguestfsd
  * New packages
    libguestfs, libguestfs-typelib-Guestfs,
    libguestfs-gobject, libguestfs-gobject-devel
    libguestfs-rescue, libguestfs-rsync, libguestfs-xfs
  * Dropped package libguestfs-test
- Dropped scripts and patches
  Pod-Simple-3.23.tar.xz
  libguestfs.test.simple.create-opensuse-guest-crypt-on-lvm.sh
  libguestfs.test.simple.create-opensuse-guest.sh
  libguestfs.test.simple.create-sles12-guest-crypt-on-lvm.sh
  libguestfs.test.simple.create-sles12-guest.sh
  libguestfs.test.simple.run-libugestfs-test-tool.sh
  0001-Introduce-a-wrapper-around-xmlParseURI.patch
  0002-common-extract-UTF-8-conversion-function.patch
  0003-inspector-rpm-summary-and-description-may-not-be-utf.patch
  489b14b7-ocaml-examples-Link-examples-to-gnulib.patch
  63c9cd93-m4-guestfs-ocaml.m4-Fix-deprecated-warning-format.patch
  68a02c2f-customize--resize--sparsify--sysprep-Link-explicitly-with-pthread.patch
  9db0c98c-appliance-enable-bashs-Process-Substitution-feature.patch
  a4930f5f-customize-Suppress-OCaml-warning.patch
  c0de4de9-appliance-add-reboot-and-netconfig-for-SUSE.patch
  e26cfa44-daemon-Build-with--pthread.patch
  f47e0bb6-appliance-reorder-mounting-of-special-filesystems-in-init.patch
  appliance.patch
  libguestfs.env.patch
  makefile-ocaml-find-guestfs.patch
  netconfig.patch</changelog>
  <changelog author="carnold@suse.com" date="1647518400">- Update to version 1.48.0
  * Fix allocation and deallocation of string lists in golang
    bindings (Laszlo Ersek).
  * Multiple fixes to the OCaml bindings:
  * Add support for Kylin (Laszlo Ersek).
  * Add support for Rocky Linux (Neil Hanlon).
  * Inspection of guests which use LUKS encryption on top of LVM
    logical volumes should now work (Laszlo Ersek).
  * "guestfs_list_9p" and "guestfs_mount_9p" are deprecated and
    now return errors.
  * "guestfs_remove_drive" has been deprecated and now returns an
    error.
  * "guestfs_add_drive" no longer supports hotplugging
  * In "guestfs_xfs_admin" the "lazycounter" parameter is deprecated
    because it is no longer supported in recent versions of XFS.
  * The User-mode Linux ("uml") backend has been removed.
  * Partition APIs now cope with the broken MBR partition tables
    created by dosfstools ≥ 4.2 (Laszlo Ersek).
  * Various bug fixes</changelog>
  <changelog author="hpj@urpla.net" date="1649851200">- Avoid useless builds, if ocaml version isn't up to the task
  libguestfs uses get_uint8(), available since ocaml 4.13.0</changelog>
  <changelog author="hpj@urpla.net" date="1649851201">- Add relevant %post{,un} sections
- Add another rpmlint filter
- Add uk man dirs</changelog>
  <changelog author="carnold@suse.com" date="1650283200">- Update to version 1.48.1
  * Updated language files
  * A few bug fixes in this release
  * Drop requirement for newer ocaml required by Bytes.get_uint8.
    It is replaced with a local implementation.</changelog>
  <changelog author="carnold@suse.com" date="1654084800">- Update to version 1.48.3
  * Several bugs fixed in this release since version 1.48.1
  * Updated language files</changelog>
  <changelog author="carnold@suse.com" date="1654257600">- bsc#1190501 - virt-builder fails to install packages when
  building an image. Add Recommends: dhcp-client for the appliance.
  libguestfs.spec</changelog>
  <changelog author="carnold@suse.com" date="1656504000">- bsc#1201064 - Libguestfs: Buffer overflow in get_keys leads
  to DOS - CVE-2022-2211
  CVE-2022-2211-options-fix-buffer-overflow-in-get_keys.patch
  CVE-2022-2211-docs-guestfs-security-document.patch</changelog>
  <changelog author="carnold@suse.com" date="1657627200">- Update to version 1.48.4
  * This is a bug fix release
- Drop patches included in new tarball
  CVE-2022-2211-docs-guestfs-security-document.patch
  CVE-2022-2211-options-fix-buffer-overflow-in-get_keys.patch</changelog>
  <changelog author="carnold@suse.com" date="1662465600">- Upstream patch to fix running configure --disable-ocaml
  f162e47e-m4-Fix-configure-disable-ocaml.patch</changelog>
  <changelog author="carnold@suse.com" date="1664884800">- jsc#PED-2113 [Virt Tools] Refresh Virtualization Tools for Xen
  and KVM Management</changelog>
  <changelog author="carnold@suse.com" date="1665748800">- Drop requirement for icoutils in SLE as this package is not
  available.
  libguestfs.spec</changelog>
  <changelog author="lnussel@suse.de" date="1666267200">- Drop reiserfs (boo#1191092)</changelog>
  <changelog author="carnold@suse.com" date="1669723200">- Update to version 1.48.6
  * jsc#PED-2113
  * This is a bug fix release. No upstream changelog.
- Drop f162e47e-m4-Fix-configure-disable-ocaml.patch</changelog>
  <changelog author="carnold@suse.com" date="1688558400">- bsc#1212972 - cannot find any suitable libguestfs supermin
  libguestfs.spec (see also bsc#1215664)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1688990400">- bsc#1213243 - KubeVirt needs libguestfs with the support of qcow2
  appliances
  Configure with --enable-appliance-format-auto to allow
  qcow2-format fixed appliances.
  libguestfs.spec</changelog>
  <changelog author="carnold@suse.com" date="1695643200">- bsc#1215543 - guestfs regression: file: Use -S option with -z
  Omit-file--S-option-on-older-distros-that-lack-support.patch
  See also bsc#1215461
- bsc#1215586 - guestfs regression: non functional network due to
  missing sysconfig-netconfig
  libguestfs.spec</changelog>
</package>
<package pkgid="e802e9e795d8ced84e2c470528e287d18e18b8a61925edb2b790641b0bd24fb0" name="libguestfs0" arch="x86_64">
  <version epoch="0" ver="1.48.6" rel="150500.3.8.1"/>
  <changelog author="carnold@suse.com" date="1635249600">- Fix build errors in Factory
  * Alert ocaml_deprecated_cli: Setting a warning with a sequence
    of lowercase or uppercase letters, like 'CDEFLMPSUVYZX', is
    deprecated.
  63c9cd93-m4-guestfs-ocaml.m4-Fix-deprecated-warning-format.patch
  * Error (warning 6 [labels-omitted]): label verbose was omitted
    in the application of this function.
  a4930f5f-customize-Suppress-OCaml-warning.patch</changelog>
  <changelog author="ohering@suse.de" date="1639483200">- Add python-rpm-macros (bsc#1180125)</changelog>
  <changelog author="carnold@suse.com" date="1644235200">- bsc#1195415 - libguestfs: consider dropping build requirement on
  systemd-sysvinit
  libguestfs.spec</changelog>
  <changelog author="carnold@suse.com" date="1645012800">- Update to version 1.46.2
  * This release has moved many virt tools like virt-builder,
    virt-cat, virt-customize, virt-df, etc. to the guestfs-tools
    project. This makes libguestfs a bit easier to build and manage.
  * The build now uses and requires PCRE2 (instead of PCRE).
  * This version requires libvirt ≥ 7.1.0, if libvirt is enabled.
  * gnulib is no longer bundled with libguestfs, making builds from
    git much simpler.
  * Perl Sys::Virt (libvirt bindings for Perl) are no longer
    required by libguestfs.
  * The code has been compiled with both LTO and GCC -fanalyzer and
    many bugs and warnings fixed.
  * Various fixes for qemu 6.1.
  * Update appliance packages on SUSE and several other improvements
    to the init script (Olaf Hering).
  * We now use the qemu / libvirt feature -cpu max to select the
    best CPU to run the appliance.
  * When passing the appliance filesystem UUID to supermin we now
    read it directly out of the appliance instead of using the
    file(1) program. This is more reliable.
  * The qemu -enable-fips option is no longer used. It was not
    needed and has been deprecated by qemu.
  * We no longer use qemu's sga (Serial Graphics Adapter) option
    ROM, instead using the equivalent seabios feature.
  * Various bug fixes
- Package changes
  * New libguestfs.spec file.
  * Moved guestfs-tools to a new and separate project and package
  * Renamed packages
    guestfs-winsupport -&gt; libguestfs-winsupport
    guestfsd -&gt; libguestfsd
  * New packages
    libguestfs, libguestfs-typelib-Guestfs,
    libguestfs-gobject, libguestfs-gobject-devel
    libguestfs-rescue, libguestfs-rsync, libguestfs-xfs
  * Dropped package libguestfs-test
- Dropped scripts and patches
  Pod-Simple-3.23.tar.xz
  libguestfs.test.simple.create-opensuse-guest-crypt-on-lvm.sh
  libguestfs.test.simple.create-opensuse-guest.sh
  libguestfs.test.simple.create-sles12-guest-crypt-on-lvm.sh
  libguestfs.test.simple.create-sles12-guest.sh
  libguestfs.test.simple.run-libugestfs-test-tool.sh
  0001-Introduce-a-wrapper-around-xmlParseURI.patch
  0002-common-extract-UTF-8-conversion-function.patch
  0003-inspector-rpm-summary-and-description-may-not-be-utf.patch
  489b14b7-ocaml-examples-Link-examples-to-gnulib.patch
  63c9cd93-m4-guestfs-ocaml.m4-Fix-deprecated-warning-format.patch
  68a02c2f-customize--resize--sparsify--sysprep-Link-explicitly-with-pthread.patch
  9db0c98c-appliance-enable-bashs-Process-Substitution-feature.patch
  a4930f5f-customize-Suppress-OCaml-warning.patch
  c0de4de9-appliance-add-reboot-and-netconfig-for-SUSE.patch
  e26cfa44-daemon-Build-with--pthread.patch
  f47e0bb6-appliance-reorder-mounting-of-special-filesystems-in-init.patch
  appliance.patch
  libguestfs.env.patch
  makefile-ocaml-find-guestfs.patch
  netconfig.patch</changelog>
  <changelog author="carnold@suse.com" date="1647518400">- Update to version 1.48.0
  * Fix allocation and deallocation of string lists in golang
    bindings (Laszlo Ersek).
  * Multiple fixes to the OCaml bindings:
  * Add support for Kylin (Laszlo Ersek).
  * Add support for Rocky Linux (Neil Hanlon).
  * Inspection of guests which use LUKS encryption on top of LVM
    logical volumes should now work (Laszlo Ersek).
  * "guestfs_list_9p" and "guestfs_mount_9p" are deprecated and
    now return errors.
  * "guestfs_remove_drive" has been deprecated and now returns an
    error.
  * "guestfs_add_drive" no longer supports hotplugging
  * In "guestfs_xfs_admin" the "lazycounter" parameter is deprecated
    because it is no longer supported in recent versions of XFS.
  * The User-mode Linux ("uml") backend has been removed.
  * Partition APIs now cope with the broken MBR partition tables
    created by dosfstools ≥ 4.2 (Laszlo Ersek).
  * Various bug fixes</changelog>
  <changelog author="hpj@urpla.net" date="1649851200">- Avoid useless builds, if ocaml version isn't up to the task
  libguestfs uses get_uint8(), available since ocaml 4.13.0</changelog>
  <changelog author="hpj@urpla.net" date="1649851201">- Add relevant %post{,un} sections
- Add another rpmlint filter
- Add uk man dirs</changelog>
  <changelog author="carnold@suse.com" date="1650283200">- Update to version 1.48.1
  * Updated language files
  * A few bug fixes in this release
  * Drop requirement for newer ocaml required by Bytes.get_uint8.
    It is replaced with a local implementation.</changelog>
  <changelog author="carnold@suse.com" date="1654084800">- Update to version 1.48.3
  * Several bugs fixed in this release since version 1.48.1
  * Updated language files</changelog>
  <changelog author="carnold@suse.com" date="1654257600">- bsc#1190501 - virt-builder fails to install packages when
  building an image. Add Recommends: dhcp-client for the appliance.
  libguestfs.spec</changelog>
  <changelog author="carnold@suse.com" date="1656504000">- bsc#1201064 - Libguestfs: Buffer overflow in get_keys leads
  to DOS - CVE-2022-2211
  CVE-2022-2211-options-fix-buffer-overflow-in-get_keys.patch
  CVE-2022-2211-docs-guestfs-security-document.patch</changelog>
  <changelog author="carnold@suse.com" date="1657627200">- Update to version 1.48.4
  * This is a bug fix release
- Drop patches included in new tarball
  CVE-2022-2211-docs-guestfs-security-document.patch
  CVE-2022-2211-options-fix-buffer-overflow-in-get_keys.patch</changelog>
  <changelog author="carnold@suse.com" date="1662465600">- Upstream patch to fix running configure --disable-ocaml
  f162e47e-m4-Fix-configure-disable-ocaml.patch</changelog>
  <changelog author="carnold@suse.com" date="1664884800">- jsc#PED-2113 [Virt Tools] Refresh Virtualization Tools for Xen
  and KVM Management</changelog>
  <changelog author="carnold@suse.com" date="1665748800">- Drop requirement for icoutils in SLE as this package is not
  available.
  libguestfs.spec</changelog>
  <changelog author="lnussel@suse.de" date="1666267200">- Drop reiserfs (boo#1191092)</changelog>
  <changelog author="carnold@suse.com" date="1669723200">- Update to version 1.48.6
  * jsc#PED-2113
  * This is a bug fix release. No upstream changelog.
- Drop f162e47e-m4-Fix-configure-disable-ocaml.patch</changelog>
  <changelog author="carnold@suse.com" date="1688558400">- bsc#1212972 - cannot find any suitable libguestfs supermin
  libguestfs.spec (see also bsc#1215664)</changelog>
  <changelog author="vasily.ulyanov@suse.com" date="1688990400">- bsc#1213243 - KubeVirt needs libguestfs with the support of qcow2
  appliances
  Configure with --enable-appliance-format-auto to allow
  qcow2-format fixed appliances.
  libguestfs.spec</changelog>
  <changelog author="carnold@suse.com" date="1695643200">- bsc#1215543 - guestfs regression: file: Use -S option with -z
  Omit-file--S-option-on-older-distros-that-lack-support.patch
  See also bsc#1215461
- bsc#1215586 - guestfs regression: non functional network due to
  missing sysconfig-netconfig
  libguestfs.spec</changelog>
</package>
<package pkgid="93c6e068d7e1d3d7179ba0da4b69b4eac92e3f3a4dc68a3866f1e472fdce95c2" name="libharfbuzz-gobject0" arch="aarch64">
  <version epoch="0" ver="3.4.0" rel="150400.3.8.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1591185600">- Update to version 2.6.7:
  + Update to Unicode 13.0.0
  + Fix hb_ot_layout_get_ligature_carets for fonts without lcar
    table
- includes fixes from 2.6.6:
  * A fix in AAT kerning for Geeza Pro</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1592913600">- update to 2.6.8:
  + New API to fetch glyph alternates from GSUB table
  + New API +hb_ot_layout_lookup_get_glyph_alternates()
- Drop gpg2 BuildRequires and stop verifying signature during
  build: upstream no longer signs the tarball/signature.</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- Update to version 2.7.2:
  + Fix a regression in the previous release that caused a crash
    with Kaithi.
  + More OOM fixes.
  + ot-funcs now handles variable empty glyphs better when
    hvar/vvar isn't present.
  + Reverted a GDEF processing regression.
  + A couple of fixes to handle OOM better.
  + Use an implementation for round that always rounds up, some
    minor fluctuations are expected on var font specially when
    hb-ot callback is used.
  + Fix an AAT's `kerx` issue on broken rendering of Devanagari
    Sangam MN.
  + Remove AAT's `lcar` table support from _get_ligature_carets
    API, not even much use on macOS installed fonts (only two
    files). GDEF support is the recommended one and expected to
    work properly after issues fixed two releases ago.
  - Minor memory fixes to handle OOM better specially in hb-ft.
  - Minor .so files versioning scheme change and remove
    stable/unstable scheme differences, was never used in practice
    (always default to stable scheme).
  - We are now suggesting careful packaging of the library using
    meson, https://github.com/harfbuzz/harfbuzz/wiki/Notes-on-migration-to-meson
    for more information.
  - Distribution package URL is changed, either use GitHub
    generated tarballs,
    `https://github.com/harfbuzz/harfbuzz/archive/$pkgver.tar.gz`
    or, even more preferably use commit hash of the release and git
    checkouts like,
    `git+https://github.com/harfbuzz/harfbuzz#commit=$commit`</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1609070400">- Update to version 2.7.4:
  + Fix missing --enable-introspection configure option
- Changes from version 2.7.3:
  + Update USE shaper to 2020-08-13 specification, and other
    improvements
  + Don’t disable liga feature in myanmar shaper, to match
    Uniscribe
  + Improvements to language and script tags handling.
  + Update language system tag registry to OpenType 1.8.4
  + Support for serializing and deserializing Unicode buffers
  + Increase buffer work limits to handle fonts with many complex
    lookups
  + Handle more shaping operations in trace output
  + Memory access fixes
  + More OOM fixes
  + Improved documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610107200">- Switch to meson buildsystem:
  + Add meson BuildRequires and macros.
  + Replace gcc-c++ for generic c++_compiler BuildRequires.
  + Add meson_test macro in check section, run tests during build.
  + Drop pkgconfig(graphite2) BuildRequires: No longer build
    graphite2 support, following upstream that disables this by
    default.
  + Stop packaging gtk-docs, pass -Ddocs=disabled to meson, this
    way we might avoid a build-cycle and since we did not have a
    explicit docs subpackage, just silently drop them.</changelog>
  <changelog author="dimstar@opensuse.org" date="1610539200">- Re-enable graphite2 support: TexLive relies on this to be
  present:
  + Pass -Dgraphite=enabled to meson.
  + Add pkgconfig(graphite2) BuildRequires.</changelog>
  <changelog author="christophe@krop.fr" date="1618315200">- Update to version 2.8.0:
  + Shape joining scripts other than Arabic/Syriac using the
    Universal Shaping Engine. Previously these were shaped using
    the generalized Arabic shaper.
  + Fix regression in shaping of U+0B55 ORIYA SIGN OVERLINE.
  + Update language tags.
  + Variations: reduce error: do not round each interpolated delta.
  + Documentation improvements.
  + Subsetter improvements: subsets most, if not all, lookup types
    now.
  + Fuzzer-found fixes and other improvements when memory failures
    happen.
  + Removed most atomic implementations now that we have C++11
    atomic impl.
  + General codebase upkeep; using more C++11 features: constexpr
    constructors, etc.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1620302400">- Update to version 2.8.1:
  + Subsetter now fully supports GSUB/GPOS/GDEF tables (including
    variations); as such, layout tables are retained by subsetter
    by default
  + hb-view supports iTerm2 and kitty inline image protocols
    it can also use Chafa for terminal graphics if available
- Add  pkgconfig(chafa): new, optional depdency.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1626264000">- Update to version 2.8.2:
  + Shaping LTR digits for RTL scripts now makes the native
    direction of the digits LTR, applying shaping and positioning
    rules on the same glyph order as Uniscribe
  + Subsetting COLR v1 and CPAL tables is now supported
  + Various fixes and improvements to the subsetter
  + When applying morx table, mark glyph widths should not be zeroed
  + GPOS is preferred over kerx, if GSUB was applied
  + Regional_Indicator pairs are grouped together when clustering</changelog>
  <changelog author="dimstar@opensuse.org" date="1626523200">- Drop pkgconfig(chafa) BuildRequires for now: causes a cycle
  between chafa and harfbuzz, and disable it in meson</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1631448000">- harfbuzz 2.9.1:
  + Subsetter API close to stable
  + Various fuzzer-found bug fixes
  + hb_buffer_append() now handles the pre- and post-context which
    previously were left unchanged in the destination buffer
  + hb-view / hb-shape now accept following new arguments:
  - -unicodes: takes a list of hex numbers that represent Unicode
    codepoints.
  + Undeprecated API: hb_set_invert()
- includes changes from 2.9.0:
  + Support multiple variation axes with same tag, aka HOI
  + The coretext testing shaper now passes font variations to
    CoreText
  + hb-shape/hb-view does not break line at new lines unless text
    is read from file
  + hb-view and hb-subset has a --batch now, similar to hb-shape
  + The --batch mode now uses ; as argument separator instead of :
    used previously
  + The --batch in hb-shape does not expect 0th argument anymore.
    That is, the lines read are interpreted as argv[1:], instead
    of argv[0:].
  + The --batch option has been undocumented. We are ready to
    document it; send feedback if you find it useful
  + hb-subset got arguments revamps. Added much-requested
  - -gids-file, --glyphs, --glyphs-file, --unicodes-file,
    supporting ranges in --unicodes.
  + Various bug fixes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1631966400">- harfbuzz 3.0.0:
  + Unicode 14.0 support
  + hb-subset API and harfbuzz-subset ABI now declared stable
  + hb-style API is now stable</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636200000">- harfbuzz 3.1.0:
  * Better offset-overflow handling in the subsetter library
  * Improved Unicode 14 properties in the USE shaper, and various
    other USE shaper fixes
  * MATH and COLR v1 tables subsetting support, and various other
    subsetter fixes
  * Support for Pwo Karen / Ason Chin medial la. (Simon Cozens)
  * Apply GPOS positioning when substituting with morx table, if
    kerx is missing
  * Apply calt and clig features across syllable boundaries in
    Indic shaper
  * Meson option for enabling Graphite 2 has been renamed to
    graphite2
  * Build and documentation fixes
- add harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636459200">- Update to version 3.1.1:
  + Work around GCC cast-align error/warning on some platforms.
  + Documentation improvements.
- Drop patch fixed upstream:
  + harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1639742400">- Update to 3.1.2:
  + hb-shape / hb-view: revert treating text on the commandline as
    single paragraph (was introduced in 3.0.0); add new
  - -single-par to do that
  + Subsetter bug fixes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1639742401">- Update to 3.2.0:
  + Fixed shaping of Apple Color Emoji flags in right-to-left context
  + Fixed positioning of CFF fonts in HB_TINY profile
  + OpenType 1.9 language tags update
  + Add HB_NO_VERTICAL config option
  + Add HB_CONFIG_OVERRIDE_H for easier configuration
  + Improved packing of cmap, loca, and Ligature tables
  + Significantly improved overflow-resolution strategy in the repacker</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1644235200">- update to 3.3.2:
  + Revert splitting of pair positioning values introduced in 3.3.0
    as it proved problematic
- includes changes from 3.3.1:
  + Fix heap-use-after-free in harfbuzz-subset introduced in
    previous release
- includes changes from 3.3.0:
  + Improved documentation, code cleanup
  + The low 16-bits of face index will be used by hb_face_create()
    to select a face inside a font collection file format, while the
    high 16-bits will be used by hb_font_create() to load the named
    instance
  + Glyph positions and other font metrics now apply synthetic slant
    set by hb_font_set_synthetic_slant(), for improved positioning
    for synthetically slanted fonts
  + Fixed unintentional locale dependency in hb_variation_to_string()
    for decimal point representation
  + When applying pair positioning (kerning) the positioning value
    is split between the two sides of the pair for improved cursor
    positioning between such pairs
  + Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in
    conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing
    re-shaping during line breaking. Check the documentation for
    further details
  + Improved handling of macrolanguages when mapping BCP 47 codes
    to OpenType tags</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1644753600">- update to 3.4.0:
  + Perform sanity checks on shaping results is now part of
    “harfbuzz” library and can be enabled by setting the buffer
    flag HB_BUFFER_FLAG_VERIFY
  + Arabic Mark Transient Reordering Algorithm have been updated
    to revision 6
  + ISO 15924 code for mathematical notation, ‘Zmth’, now maps to
    the OpenType ‘math’ tag
  + It is now possible to get at once all math kerning values for a
    given glyph at a given corner
  + Fix locale_t portability issues on systems the typedef’s it to
    a void pointer</changelog>
  <changelog author="mgorse@suse.com" date="1658836800">- Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents
  (boo#1200900 CVE-2022-33068).</changelog>
  <changelog author="mgorse@suse.com" date="1680696000">- Add CVE-2023-25193.patch: limit how far we skip when looking
  back (bsc#1207922 CVE-2023-25193).</changelog>
</package>
<package pkgid="7e60f74ebdb3c1ee7597b8726a1528ac63ad13aa2428c1dd5672e77a221c40bf" name="libharfbuzz-gobject0" arch="s390x">
  <version epoch="0" ver="3.4.0" rel="150400.3.8.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1591185600">- Update to version 2.6.7:
  + Update to Unicode 13.0.0
  + Fix hb_ot_layout_get_ligature_carets for fonts without lcar
    table
- includes fixes from 2.6.6:
  * A fix in AAT kerning for Geeza Pro</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1592913600">- update to 2.6.8:
  + New API to fetch glyph alternates from GSUB table
  + New API +hb_ot_layout_lookup_get_glyph_alternates()
- Drop gpg2 BuildRequires and stop verifying signature during
  build: upstream no longer signs the tarball/signature.</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- Update to version 2.7.2:
  + Fix a regression in the previous release that caused a crash
    with Kaithi.
  + More OOM fixes.
  + ot-funcs now handles variable empty glyphs better when
    hvar/vvar isn't present.
  + Reverted a GDEF processing regression.
  + A couple of fixes to handle OOM better.
  + Use an implementation for round that always rounds up, some
    minor fluctuations are expected on var font specially when
    hb-ot callback is used.
  + Fix an AAT's `kerx` issue on broken rendering of Devanagari
    Sangam MN.
  + Remove AAT's `lcar` table support from _get_ligature_carets
    API, not even much use on macOS installed fonts (only two
    files). GDEF support is the recommended one and expected to
    work properly after issues fixed two releases ago.
  - Minor memory fixes to handle OOM better specially in hb-ft.
  - Minor .so files versioning scheme change and remove
    stable/unstable scheme differences, was never used in practice
    (always default to stable scheme).
  - We are now suggesting careful packaging of the library using
    meson, https://github.com/harfbuzz/harfbuzz/wiki/Notes-on-migration-to-meson
    for more information.
  - Distribution package URL is changed, either use GitHub
    generated tarballs,
    `https://github.com/harfbuzz/harfbuzz/archive/$pkgver.tar.gz`
    or, even more preferably use commit hash of the release and git
    checkouts like,
    `git+https://github.com/harfbuzz/harfbuzz#commit=$commit`</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1609070400">- Update to version 2.7.4:
  + Fix missing --enable-introspection configure option
- Changes from version 2.7.3:
  + Update USE shaper to 2020-08-13 specification, and other
    improvements
  + Don’t disable liga feature in myanmar shaper, to match
    Uniscribe
  + Improvements to language and script tags handling.
  + Update language system tag registry to OpenType 1.8.4
  + Support for serializing and deserializing Unicode buffers
  + Increase buffer work limits to handle fonts with many complex
    lookups
  + Handle more shaping operations in trace output
  + Memory access fixes
  + More OOM fixes
  + Improved documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610107200">- Switch to meson buildsystem:
  + Add meson BuildRequires and macros.
  + Replace gcc-c++ for generic c++_compiler BuildRequires.
  + Add meson_test macro in check section, run tests during build.
  + Drop pkgconfig(graphite2) BuildRequires: No longer build
    graphite2 support, following upstream that disables this by
    default.
  + Stop packaging gtk-docs, pass -Ddocs=disabled to meson, this
    way we might avoid a build-cycle and since we did not have a
    explicit docs subpackage, just silently drop them.</changelog>
  <changelog author="dimstar@opensuse.org" date="1610539200">- Re-enable graphite2 support: TexLive relies on this to be
  present:
  + Pass -Dgraphite=enabled to meson.
  + Add pkgconfig(graphite2) BuildRequires.</changelog>
  <changelog author="christophe@krop.fr" date="1618315200">- Update to version 2.8.0:
  + Shape joining scripts other than Arabic/Syriac using the
    Universal Shaping Engine. Previously these were shaped using
    the generalized Arabic shaper.
  + Fix regression in shaping of U+0B55 ORIYA SIGN OVERLINE.
  + Update language tags.
  + Variations: reduce error: do not round each interpolated delta.
  + Documentation improvements.
  + Subsetter improvements: subsets most, if not all, lookup types
    now.
  + Fuzzer-found fixes and other improvements when memory failures
    happen.
  + Removed most atomic implementations now that we have C++11
    atomic impl.
  + General codebase upkeep; using more C++11 features: constexpr
    constructors, etc.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1620302400">- Update to version 2.8.1:
  + Subsetter now fully supports GSUB/GPOS/GDEF tables (including
    variations); as such, layout tables are retained by subsetter
    by default
  + hb-view supports iTerm2 and kitty inline image protocols
    it can also use Chafa for terminal graphics if available
- Add  pkgconfig(chafa): new, optional depdency.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1626264000">- Update to version 2.8.2:
  + Shaping LTR digits for RTL scripts now makes the native
    direction of the digits LTR, applying shaping and positioning
    rules on the same glyph order as Uniscribe
  + Subsetting COLR v1 and CPAL tables is now supported
  + Various fixes and improvements to the subsetter
  + When applying morx table, mark glyph widths should not be zeroed
  + GPOS is preferred over kerx, if GSUB was applied
  + Regional_Indicator pairs are grouped together when clustering</changelog>
  <changelog author="dimstar@opensuse.org" date="1626523200">- Drop pkgconfig(chafa) BuildRequires for now: causes a cycle
  between chafa and harfbuzz, and disable it in meson</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1631448000">- harfbuzz 2.9.1:
  + Subsetter API close to stable
  + Various fuzzer-found bug fixes
  + hb_buffer_append() now handles the pre- and post-context which
    previously were left unchanged in the destination buffer
  + hb-view / hb-shape now accept following new arguments:
  - -unicodes: takes a list of hex numbers that represent Unicode
    codepoints.
  + Undeprecated API: hb_set_invert()
- includes changes from 2.9.0:
  + Support multiple variation axes with same tag, aka HOI
  + The coretext testing shaper now passes font variations to
    CoreText
  + hb-shape/hb-view does not break line at new lines unless text
    is read from file
  + hb-view and hb-subset has a --batch now, similar to hb-shape
  + The --batch mode now uses ; as argument separator instead of :
    used previously
  + The --batch in hb-shape does not expect 0th argument anymore.
    That is, the lines read are interpreted as argv[1:], instead
    of argv[0:].
  + The --batch option has been undocumented. We are ready to
    document it; send feedback if you find it useful
  + hb-subset got arguments revamps. Added much-requested
  - -gids-file, --glyphs, --glyphs-file, --unicodes-file,
    supporting ranges in --unicodes.
  + Various bug fixes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1631966400">- harfbuzz 3.0.0:
  + Unicode 14.0 support
  + hb-subset API and harfbuzz-subset ABI now declared stable
  + hb-style API is now stable</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636200000">- harfbuzz 3.1.0:
  * Better offset-overflow handling in the subsetter library
  * Improved Unicode 14 properties in the USE shaper, and various
    other USE shaper fixes
  * MATH and COLR v1 tables subsetting support, and various other
    subsetter fixes
  * Support for Pwo Karen / Ason Chin medial la. (Simon Cozens)
  * Apply GPOS positioning when substituting with morx table, if
    kerx is missing
  * Apply calt and clig features across syllable boundaries in
    Indic shaper
  * Meson option for enabling Graphite 2 has been renamed to
    graphite2
  * Build and documentation fixes
- add harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636459200">- Update to version 3.1.1:
  + Work around GCC cast-align error/warning on some platforms.
  + Documentation improvements.
- Drop patch fixed upstream:
  + harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1639742400">- Update to 3.1.2:
  + hb-shape / hb-view: revert treating text on the commandline as
    single paragraph (was introduced in 3.0.0); add new
  - -single-par to do that
  + Subsetter bug fixes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1639742401">- Update to 3.2.0:
  + Fixed shaping of Apple Color Emoji flags in right-to-left context
  + Fixed positioning of CFF fonts in HB_TINY profile
  + OpenType 1.9 language tags update
  + Add HB_NO_VERTICAL config option
  + Add HB_CONFIG_OVERRIDE_H for easier configuration
  + Improved packing of cmap, loca, and Ligature tables
  + Significantly improved overflow-resolution strategy in the repacker</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1644235200">- update to 3.3.2:
  + Revert splitting of pair positioning values introduced in 3.3.0
    as it proved problematic
- includes changes from 3.3.1:
  + Fix heap-use-after-free in harfbuzz-subset introduced in
    previous release
- includes changes from 3.3.0:
  + Improved documentation, code cleanup
  + The low 16-bits of face index will be used by hb_face_create()
    to select a face inside a font collection file format, while the
    high 16-bits will be used by hb_font_create() to load the named
    instance
  + Glyph positions and other font metrics now apply synthetic slant
    set by hb_font_set_synthetic_slant(), for improved positioning
    for synthetically slanted fonts
  + Fixed unintentional locale dependency in hb_variation_to_string()
    for decimal point representation
  + When applying pair positioning (kerning) the positioning value
    is split between the two sides of the pair for improved cursor
    positioning between such pairs
  + Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in
    conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing
    re-shaping during line breaking. Check the documentation for
    further details
  + Improved handling of macrolanguages when mapping BCP 47 codes
    to OpenType tags</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1644753600">- update to 3.4.0:
  + Perform sanity checks on shaping results is now part of
    “harfbuzz” library and can be enabled by setting the buffer
    flag HB_BUFFER_FLAG_VERIFY
  + Arabic Mark Transient Reordering Algorithm have been updated
    to revision 6
  + ISO 15924 code for mathematical notation, ‘Zmth’, now maps to
    the OpenType ‘math’ tag
  + It is now possible to get at once all math kerning values for a
    given glyph at a given corner
  + Fix locale_t portability issues on systems the typedef’s it to
    a void pointer</changelog>
  <changelog author="mgorse@suse.com" date="1658836800">- Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents
  (boo#1200900 CVE-2022-33068).</changelog>
  <changelog author="mgorse@suse.com" date="1680696000">- Add CVE-2023-25193.patch: limit how far we skip when looking
  back (bsc#1207922 CVE-2023-25193).</changelog>
</package>
<package pkgid="599907df87599767d39f0ef35a6bb5436e8186a3e1a3012f99d8528d29a1af78" name="libharfbuzz-gobject0" arch="x86_64">
  <version epoch="0" ver="3.4.0" rel="150400.3.8.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1591185600">- Update to version 2.6.7:
  + Update to Unicode 13.0.0
  + Fix hb_ot_layout_get_ligature_carets for fonts without lcar
    table
- includes fixes from 2.6.6:
  * A fix in AAT kerning for Geeza Pro</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1592913600">- update to 2.6.8:
  + New API to fetch glyph alternates from GSUB table
  + New API +hb_ot_layout_lookup_get_glyph_alternates()
- Drop gpg2 BuildRequires and stop verifying signature during
  build: upstream no longer signs the tarball/signature.</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- Update to version 2.7.2:
  + Fix a regression in the previous release that caused a crash
    with Kaithi.
  + More OOM fixes.
  + ot-funcs now handles variable empty glyphs better when
    hvar/vvar isn't present.
  + Reverted a GDEF processing regression.
  + A couple of fixes to handle OOM better.
  + Use an implementation for round that always rounds up, some
    minor fluctuations are expected on var font specially when
    hb-ot callback is used.
  + Fix an AAT's `kerx` issue on broken rendering of Devanagari
    Sangam MN.
  + Remove AAT's `lcar` table support from _get_ligature_carets
    API, not even much use on macOS installed fonts (only two
    files). GDEF support is the recommended one and expected to
    work properly after issues fixed two releases ago.
  - Minor memory fixes to handle OOM better specially in hb-ft.
  - Minor .so files versioning scheme change and remove
    stable/unstable scheme differences, was never used in practice
    (always default to stable scheme).
  - We are now suggesting careful packaging of the library using
    meson, https://github.com/harfbuzz/harfbuzz/wiki/Notes-on-migration-to-meson
    for more information.
  - Distribution package URL is changed, either use GitHub
    generated tarballs,
    `https://github.com/harfbuzz/harfbuzz/archive/$pkgver.tar.gz`
    or, even more preferably use commit hash of the release and git
    checkouts like,
    `git+https://github.com/harfbuzz/harfbuzz#commit=$commit`</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1609070400">- Update to version 2.7.4:
  + Fix missing --enable-introspection configure option
- Changes from version 2.7.3:
  + Update USE shaper to 2020-08-13 specification, and other
    improvements
  + Don’t disable liga feature in myanmar shaper, to match
    Uniscribe
  + Improvements to language and script tags handling.
  + Update language system tag registry to OpenType 1.8.4
  + Support for serializing and deserializing Unicode buffers
  + Increase buffer work limits to handle fonts with many complex
    lookups
  + Handle more shaping operations in trace output
  + Memory access fixes
  + More OOM fixes
  + Improved documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610107200">- Switch to meson buildsystem:
  + Add meson BuildRequires and macros.
  + Replace gcc-c++ for generic c++_compiler BuildRequires.
  + Add meson_test macro in check section, run tests during build.
  + Drop pkgconfig(graphite2) BuildRequires: No longer build
    graphite2 support, following upstream that disables this by
    default.
  + Stop packaging gtk-docs, pass -Ddocs=disabled to meson, this
    way we might avoid a build-cycle and since we did not have a
    explicit docs subpackage, just silently drop them.</changelog>
  <changelog author="dimstar@opensuse.org" date="1610539200">- Re-enable graphite2 support: TexLive relies on this to be
  present:
  + Pass -Dgraphite=enabled to meson.
  + Add pkgconfig(graphite2) BuildRequires.</changelog>
  <changelog author="christophe@krop.fr" date="1618315200">- Update to version 2.8.0:
  + Shape joining scripts other than Arabic/Syriac using the
    Universal Shaping Engine. Previously these were shaped using
    the generalized Arabic shaper.
  + Fix regression in shaping of U+0B55 ORIYA SIGN OVERLINE.
  + Update language tags.
  + Variations: reduce error: do not round each interpolated delta.
  + Documentation improvements.
  + Subsetter improvements: subsets most, if not all, lookup types
    now.
  + Fuzzer-found fixes and other improvements when memory failures
    happen.
  + Removed most atomic implementations now that we have C++11
    atomic impl.
  + General codebase upkeep; using more C++11 features: constexpr
    constructors, etc.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1620302400">- Update to version 2.8.1:
  + Subsetter now fully supports GSUB/GPOS/GDEF tables (including
    variations); as such, layout tables are retained by subsetter
    by default
  + hb-view supports iTerm2 and kitty inline image protocols
    it can also use Chafa for terminal graphics if available
- Add  pkgconfig(chafa): new, optional depdency.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1626264000">- Update to version 2.8.2:
  + Shaping LTR digits for RTL scripts now makes the native
    direction of the digits LTR, applying shaping and positioning
    rules on the same glyph order as Uniscribe
  + Subsetting COLR v1 and CPAL tables is now supported
  + Various fixes and improvements to the subsetter
  + When applying morx table, mark glyph widths should not be zeroed
  + GPOS is preferred over kerx, if GSUB was applied
  + Regional_Indicator pairs are grouped together when clustering</changelog>
  <changelog author="dimstar@opensuse.org" date="1626523200">- Drop pkgconfig(chafa) BuildRequires for now: causes a cycle
  between chafa and harfbuzz, and disable it in meson</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1631448000">- harfbuzz 2.9.1:
  + Subsetter API close to stable
  + Various fuzzer-found bug fixes
  + hb_buffer_append() now handles the pre- and post-context which
    previously were left unchanged in the destination buffer
  + hb-view / hb-shape now accept following new arguments:
  - -unicodes: takes a list of hex numbers that represent Unicode
    codepoints.
  + Undeprecated API: hb_set_invert()
- includes changes from 2.9.0:
  + Support multiple variation axes with same tag, aka HOI
  + The coretext testing shaper now passes font variations to
    CoreText
  + hb-shape/hb-view does not break line at new lines unless text
    is read from file
  + hb-view and hb-subset has a --batch now, similar to hb-shape
  + The --batch mode now uses ; as argument separator instead of :
    used previously
  + The --batch in hb-shape does not expect 0th argument anymore.
    That is, the lines read are interpreted as argv[1:], instead
    of argv[0:].
  + The --batch option has been undocumented. We are ready to
    document it; send feedback if you find it useful
  + hb-subset got arguments revamps. Added much-requested
  - -gids-file, --glyphs, --glyphs-file, --unicodes-file,
    supporting ranges in --unicodes.
  + Various bug fixes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1631966400">- harfbuzz 3.0.0:
  + Unicode 14.0 support
  + hb-subset API and harfbuzz-subset ABI now declared stable
  + hb-style API is now stable</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636200000">- harfbuzz 3.1.0:
  * Better offset-overflow handling in the subsetter library
  * Improved Unicode 14 properties in the USE shaper, and various
    other USE shaper fixes
  * MATH and COLR v1 tables subsetting support, and various other
    subsetter fixes
  * Support for Pwo Karen / Ason Chin medial la. (Simon Cozens)
  * Apply GPOS positioning when substituting with morx table, if
    kerx is missing
  * Apply calt and clig features across syllable boundaries in
    Indic shaper
  * Meson option for enabling Graphite 2 has been renamed to
    graphite2
  * Build and documentation fixes
- add harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636459200">- Update to version 3.1.1:
  + Work around GCC cast-align error/warning on some platforms.
  + Documentation improvements.
- Drop patch fixed upstream:
  + harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1639742400">- Update to 3.1.2:
  + hb-shape / hb-view: revert treating text on the commandline as
    single paragraph (was introduced in 3.0.0); add new
  - -single-par to do that
  + Subsetter bug fixes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1639742401">- Update to 3.2.0:
  + Fixed shaping of Apple Color Emoji flags in right-to-left context
  + Fixed positioning of CFF fonts in HB_TINY profile
  + OpenType 1.9 language tags update
  + Add HB_NO_VERTICAL config option
  + Add HB_CONFIG_OVERRIDE_H for easier configuration
  + Improved packing of cmap, loca, and Ligature tables
  + Significantly improved overflow-resolution strategy in the repacker</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1644235200">- update to 3.3.2:
  + Revert splitting of pair positioning values introduced in 3.3.0
    as it proved problematic
- includes changes from 3.3.1:
  + Fix heap-use-after-free in harfbuzz-subset introduced in
    previous release
- includes changes from 3.3.0:
  + Improved documentation, code cleanup
  + The low 16-bits of face index will be used by hb_face_create()
    to select a face inside a font collection file format, while the
    high 16-bits will be used by hb_font_create() to load the named
    instance
  + Glyph positions and other font metrics now apply synthetic slant
    set by hb_font_set_synthetic_slant(), for improved positioning
    for synthetically slanted fonts
  + Fixed unintentional locale dependency in hb_variation_to_string()
    for decimal point representation
  + When applying pair positioning (kerning) the positioning value
    is split between the two sides of the pair for improved cursor
    positioning between such pairs
  + Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in
    conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing
    re-shaping during line breaking. Check the documentation for
    further details
  + Improved handling of macrolanguages when mapping BCP 47 codes
    to OpenType tags</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1644753600">- update to 3.4.0:
  + Perform sanity checks on shaping results is now part of
    “harfbuzz” library and can be enabled by setting the buffer
    flag HB_BUFFER_FLAG_VERIFY
  + Arabic Mark Transient Reordering Algorithm have been updated
    to revision 6
  + ISO 15924 code for mathematical notation, ‘Zmth’, now maps to
    the OpenType ‘math’ tag
  + It is now possible to get at once all math kerning values for a
    given glyph at a given corner
  + Fix locale_t portability issues on systems the typedef’s it to
    a void pointer</changelog>
  <changelog author="mgorse@suse.com" date="1658836800">- Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents
  (boo#1200900 CVE-2022-33068).</changelog>
  <changelog author="mgorse@suse.com" date="1680696000">- Add CVE-2023-25193.patch: limit how far we skip when looking
  back (bsc#1207922 CVE-2023-25193).</changelog>
</package>
<package pkgid="c92c23512df2313de55d8db8cc8d16c92c4b78255bf9f3322866d0a97fcb2c64" name="libharfbuzz0" arch="aarch64">
  <version epoch="0" ver="3.4.0" rel="150400.3.8.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1591185600">- Update to version 2.6.7:
  + Update to Unicode 13.0.0
  + Fix hb_ot_layout_get_ligature_carets for fonts without lcar
    table
- includes fixes from 2.6.6:
  * A fix in AAT kerning for Geeza Pro</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1592913600">- update to 2.6.8:
  + New API to fetch glyph alternates from GSUB table
  + New API +hb_ot_layout_lookup_get_glyph_alternates()
- Drop gpg2 BuildRequires and stop verifying signature during
  build: upstream no longer signs the tarball/signature.</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- Update to version 2.7.2:
  + Fix a regression in the previous release that caused a crash
    with Kaithi.
  + More OOM fixes.
  + ot-funcs now handles variable empty glyphs better when
    hvar/vvar isn't present.
  + Reverted a GDEF processing regression.
  + A couple of fixes to handle OOM better.
  + Use an implementation for round that always rounds up, some
    minor fluctuations are expected on var font specially when
    hb-ot callback is used.
  + Fix an AAT's `kerx` issue on broken rendering of Devanagari
    Sangam MN.
  + Remove AAT's `lcar` table support from _get_ligature_carets
    API, not even much use on macOS installed fonts (only two
    files). GDEF support is the recommended one and expected to
    work properly after issues fixed two releases ago.
  - Minor memory fixes to handle OOM better specially in hb-ft.
  - Minor .so files versioning scheme change and remove
    stable/unstable scheme differences, was never used in practice
    (always default to stable scheme).
  - We are now suggesting careful packaging of the library using
    meson, https://github.com/harfbuzz/harfbuzz/wiki/Notes-on-migration-to-meson
    for more information.
  - Distribution package URL is changed, either use GitHub
    generated tarballs,
    `https://github.com/harfbuzz/harfbuzz/archive/$pkgver.tar.gz`
    or, even more preferably use commit hash of the release and git
    checkouts like,
    `git+https://github.com/harfbuzz/harfbuzz#commit=$commit`</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1609070400">- Update to version 2.7.4:
  + Fix missing --enable-introspection configure option
- Changes from version 2.7.3:
  + Update USE shaper to 2020-08-13 specification, and other
    improvements
  + Don’t disable liga feature in myanmar shaper, to match
    Uniscribe
  + Improvements to language and script tags handling.
  + Update language system tag registry to OpenType 1.8.4
  + Support for serializing and deserializing Unicode buffers
  + Increase buffer work limits to handle fonts with many complex
    lookups
  + Handle more shaping operations in trace output
  + Memory access fixes
  + More OOM fixes
  + Improved documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610107200">- Switch to meson buildsystem:
  + Add meson BuildRequires and macros.
  + Replace gcc-c++ for generic c++_compiler BuildRequires.
  + Add meson_test macro in check section, run tests during build.
  + Drop pkgconfig(graphite2) BuildRequires: No longer build
    graphite2 support, following upstream that disables this by
    default.
  + Stop packaging gtk-docs, pass -Ddocs=disabled to meson, this
    way we might avoid a build-cycle and since we did not have a
    explicit docs subpackage, just silently drop them.</changelog>
  <changelog author="dimstar@opensuse.org" date="1610539200">- Re-enable graphite2 support: TexLive relies on this to be
  present:
  + Pass -Dgraphite=enabled to meson.
  + Add pkgconfig(graphite2) BuildRequires.</changelog>
  <changelog author="christophe@krop.fr" date="1618315200">- Update to version 2.8.0:
  + Shape joining scripts other than Arabic/Syriac using the
    Universal Shaping Engine. Previously these were shaped using
    the generalized Arabic shaper.
  + Fix regression in shaping of U+0B55 ORIYA SIGN OVERLINE.
  + Update language tags.
  + Variations: reduce error: do not round each interpolated delta.
  + Documentation improvements.
  + Subsetter improvements: subsets most, if not all, lookup types
    now.
  + Fuzzer-found fixes and other improvements when memory failures
    happen.
  + Removed most atomic implementations now that we have C++11
    atomic impl.
  + General codebase upkeep; using more C++11 features: constexpr
    constructors, etc.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1620302400">- Update to version 2.8.1:
  + Subsetter now fully supports GSUB/GPOS/GDEF tables (including
    variations); as such, layout tables are retained by subsetter
    by default
  + hb-view supports iTerm2 and kitty inline image protocols
    it can also use Chafa for terminal graphics if available
- Add  pkgconfig(chafa): new, optional depdency.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1626264000">- Update to version 2.8.2:
  + Shaping LTR digits for RTL scripts now makes the native
    direction of the digits LTR, applying shaping and positioning
    rules on the same glyph order as Uniscribe
  + Subsetting COLR v1 and CPAL tables is now supported
  + Various fixes and improvements to the subsetter
  + When applying morx table, mark glyph widths should not be zeroed
  + GPOS is preferred over kerx, if GSUB was applied
  + Regional_Indicator pairs are grouped together when clustering</changelog>
  <changelog author="dimstar@opensuse.org" date="1626523200">- Drop pkgconfig(chafa) BuildRequires for now: causes a cycle
  between chafa and harfbuzz, and disable it in meson</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1631448000">- harfbuzz 2.9.1:
  + Subsetter API close to stable
  + Various fuzzer-found bug fixes
  + hb_buffer_append() now handles the pre- and post-context which
    previously were left unchanged in the destination buffer
  + hb-view / hb-shape now accept following new arguments:
  - -unicodes: takes a list of hex numbers that represent Unicode
    codepoints.
  + Undeprecated API: hb_set_invert()
- includes changes from 2.9.0:
  + Support multiple variation axes with same tag, aka HOI
  + The coretext testing shaper now passes font variations to
    CoreText
  + hb-shape/hb-view does not break line at new lines unless text
    is read from file
  + hb-view and hb-subset has a --batch now, similar to hb-shape
  + The --batch mode now uses ; as argument separator instead of :
    used previously
  + The --batch in hb-shape does not expect 0th argument anymore.
    That is, the lines read are interpreted as argv[1:], instead
    of argv[0:].
  + The --batch option has been undocumented. We are ready to
    document it; send feedback if you find it useful
  + hb-subset got arguments revamps. Added much-requested
  - -gids-file, --glyphs, --glyphs-file, --unicodes-file,
    supporting ranges in --unicodes.
  + Various bug fixes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1631966400">- harfbuzz 3.0.0:
  + Unicode 14.0 support
  + hb-subset API and harfbuzz-subset ABI now declared stable
  + hb-style API is now stable</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636200000">- harfbuzz 3.1.0:
  * Better offset-overflow handling in the subsetter library
  * Improved Unicode 14 properties in the USE shaper, and various
    other USE shaper fixes
  * MATH and COLR v1 tables subsetting support, and various other
    subsetter fixes
  * Support for Pwo Karen / Ason Chin medial la. (Simon Cozens)
  * Apply GPOS positioning when substituting with morx table, if
    kerx is missing
  * Apply calt and clig features across syllable boundaries in
    Indic shaper
  * Meson option for enabling Graphite 2 has been renamed to
    graphite2
  * Build and documentation fixes
- add harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636459200">- Update to version 3.1.1:
  + Work around GCC cast-align error/warning on some platforms.
  + Documentation improvements.
- Drop patch fixed upstream:
  + harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1639742400">- Update to 3.1.2:
  + hb-shape / hb-view: revert treating text on the commandline as
    single paragraph (was introduced in 3.0.0); add new
  - -single-par to do that
  + Subsetter bug fixes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1639742401">- Update to 3.2.0:
  + Fixed shaping of Apple Color Emoji flags in right-to-left context
  + Fixed positioning of CFF fonts in HB_TINY profile
  + OpenType 1.9 language tags update
  + Add HB_NO_VERTICAL config option
  + Add HB_CONFIG_OVERRIDE_H for easier configuration
  + Improved packing of cmap, loca, and Ligature tables
  + Significantly improved overflow-resolution strategy in the repacker</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1644235200">- update to 3.3.2:
  + Revert splitting of pair positioning values introduced in 3.3.0
    as it proved problematic
- includes changes from 3.3.1:
  + Fix heap-use-after-free in harfbuzz-subset introduced in
    previous release
- includes changes from 3.3.0:
  + Improved documentation, code cleanup
  + The low 16-bits of face index will be used by hb_face_create()
    to select a face inside a font collection file format, while the
    high 16-bits will be used by hb_font_create() to load the named
    instance
  + Glyph positions and other font metrics now apply synthetic slant
    set by hb_font_set_synthetic_slant(), for improved positioning
    for synthetically slanted fonts
  + Fixed unintentional locale dependency in hb_variation_to_string()
    for decimal point representation
  + When applying pair positioning (kerning) the positioning value
    is split between the two sides of the pair for improved cursor
    positioning between such pairs
  + Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in
    conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing
    re-shaping during line breaking. Check the documentation for
    further details
  + Improved handling of macrolanguages when mapping BCP 47 codes
    to OpenType tags</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1644753600">- update to 3.4.0:
  + Perform sanity checks on shaping results is now part of
    “harfbuzz” library and can be enabled by setting the buffer
    flag HB_BUFFER_FLAG_VERIFY
  + Arabic Mark Transient Reordering Algorithm have been updated
    to revision 6
  + ISO 15924 code for mathematical notation, ‘Zmth’, now maps to
    the OpenType ‘math’ tag
  + It is now possible to get at once all math kerning values for a
    given glyph at a given corner
  + Fix locale_t portability issues on systems the typedef’s it to
    a void pointer</changelog>
  <changelog author="mgorse@suse.com" date="1658836800">- Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents
  (boo#1200900 CVE-2022-33068).</changelog>
  <changelog author="mgorse@suse.com" date="1680696000">- Add CVE-2023-25193.patch: limit how far we skip when looking
  back (bsc#1207922 CVE-2023-25193).</changelog>
</package>
<package pkgid="73ceb5906cf7f4ce4efaf1b7f42b5f84a2edb8b8c94e6bc4ca3885bcd4cf0708" name="libharfbuzz0" arch="s390x">
  <version epoch="0" ver="3.4.0" rel="150400.3.8.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1591185600">- Update to version 2.6.7:
  + Update to Unicode 13.0.0
  + Fix hb_ot_layout_get_ligature_carets for fonts without lcar
    table
- includes fixes from 2.6.6:
  * A fix in AAT kerning for Geeza Pro</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1592913600">- update to 2.6.8:
  + New API to fetch glyph alternates from GSUB table
  + New API +hb_ot_layout_lookup_get_glyph_alternates()
- Drop gpg2 BuildRequires and stop verifying signature during
  build: upstream no longer signs the tarball/signature.</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- Update to version 2.7.2:
  + Fix a regression in the previous release that caused a crash
    with Kaithi.
  + More OOM fixes.
  + ot-funcs now handles variable empty glyphs better when
    hvar/vvar isn't present.
  + Reverted a GDEF processing regression.
  + A couple of fixes to handle OOM better.
  + Use an implementation for round that always rounds up, some
    minor fluctuations are expected on var font specially when
    hb-ot callback is used.
  + Fix an AAT's `kerx` issue on broken rendering of Devanagari
    Sangam MN.
  + Remove AAT's `lcar` table support from _get_ligature_carets
    API, not even much use on macOS installed fonts (only two
    files). GDEF support is the recommended one and expected to
    work properly after issues fixed two releases ago.
  - Minor memory fixes to handle OOM better specially in hb-ft.
  - Minor .so files versioning scheme change and remove
    stable/unstable scheme differences, was never used in practice
    (always default to stable scheme).
  - We are now suggesting careful packaging of the library using
    meson, https://github.com/harfbuzz/harfbuzz/wiki/Notes-on-migration-to-meson
    for more information.
  - Distribution package URL is changed, either use GitHub
    generated tarballs,
    `https://github.com/harfbuzz/harfbuzz/archive/$pkgver.tar.gz`
    or, even more preferably use commit hash of the release and git
    checkouts like,
    `git+https://github.com/harfbuzz/harfbuzz#commit=$commit`</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1609070400">- Update to version 2.7.4:
  + Fix missing --enable-introspection configure option
- Changes from version 2.7.3:
  + Update USE shaper to 2020-08-13 specification, and other
    improvements
  + Don’t disable liga feature in myanmar shaper, to match
    Uniscribe
  + Improvements to language and script tags handling.
  + Update language system tag registry to OpenType 1.8.4
  + Support for serializing and deserializing Unicode buffers
  + Increase buffer work limits to handle fonts with many complex
    lookups
  + Handle more shaping operations in trace output
  + Memory access fixes
  + More OOM fixes
  + Improved documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610107200">- Switch to meson buildsystem:
  + Add meson BuildRequires and macros.
  + Replace gcc-c++ for generic c++_compiler BuildRequires.
  + Add meson_test macro in check section, run tests during build.
  + Drop pkgconfig(graphite2) BuildRequires: No longer build
    graphite2 support, following upstream that disables this by
    default.
  + Stop packaging gtk-docs, pass -Ddocs=disabled to meson, this
    way we might avoid a build-cycle and since we did not have a
    explicit docs subpackage, just silently drop them.</changelog>
  <changelog author="dimstar@opensuse.org" date="1610539200">- Re-enable graphite2 support: TexLive relies on this to be
  present:
  + Pass -Dgraphite=enabled to meson.
  + Add pkgconfig(graphite2) BuildRequires.</changelog>
  <changelog author="christophe@krop.fr" date="1618315200">- Update to version 2.8.0:
  + Shape joining scripts other than Arabic/Syriac using the
    Universal Shaping Engine. Previously these were shaped using
    the generalized Arabic shaper.
  + Fix regression in shaping of U+0B55 ORIYA SIGN OVERLINE.
  + Update language tags.
  + Variations: reduce error: do not round each interpolated delta.
  + Documentation improvements.
  + Subsetter improvements: subsets most, if not all, lookup types
    now.
  + Fuzzer-found fixes and other improvements when memory failures
    happen.
  + Removed most atomic implementations now that we have C++11
    atomic impl.
  + General codebase upkeep; using more C++11 features: constexpr
    constructors, etc.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1620302400">- Update to version 2.8.1:
  + Subsetter now fully supports GSUB/GPOS/GDEF tables (including
    variations); as such, layout tables are retained by subsetter
    by default
  + hb-view supports iTerm2 and kitty inline image protocols
    it can also use Chafa for terminal graphics if available
- Add  pkgconfig(chafa): new, optional depdency.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1626264000">- Update to version 2.8.2:
  + Shaping LTR digits for RTL scripts now makes the native
    direction of the digits LTR, applying shaping and positioning
    rules on the same glyph order as Uniscribe
  + Subsetting COLR v1 and CPAL tables is now supported
  + Various fixes and improvements to the subsetter
  + When applying morx table, mark glyph widths should not be zeroed
  + GPOS is preferred over kerx, if GSUB was applied
  + Regional_Indicator pairs are grouped together when clustering</changelog>
  <changelog author="dimstar@opensuse.org" date="1626523200">- Drop pkgconfig(chafa) BuildRequires for now: causes a cycle
  between chafa and harfbuzz, and disable it in meson</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1631448000">- harfbuzz 2.9.1:
  + Subsetter API close to stable
  + Various fuzzer-found bug fixes
  + hb_buffer_append() now handles the pre- and post-context which
    previously were left unchanged in the destination buffer
  + hb-view / hb-shape now accept following new arguments:
  - -unicodes: takes a list of hex numbers that represent Unicode
    codepoints.
  + Undeprecated API: hb_set_invert()
- includes changes from 2.9.0:
  + Support multiple variation axes with same tag, aka HOI
  + The coretext testing shaper now passes font variations to
    CoreText
  + hb-shape/hb-view does not break line at new lines unless text
    is read from file
  + hb-view and hb-subset has a --batch now, similar to hb-shape
  + The --batch mode now uses ; as argument separator instead of :
    used previously
  + The --batch in hb-shape does not expect 0th argument anymore.
    That is, the lines read are interpreted as argv[1:], instead
    of argv[0:].
  + The --batch option has been undocumented. We are ready to
    document it; send feedback if you find it useful
  + hb-subset got arguments revamps. Added much-requested
  - -gids-file, --glyphs, --glyphs-file, --unicodes-file,
    supporting ranges in --unicodes.
  + Various bug fixes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1631966400">- harfbuzz 3.0.0:
  + Unicode 14.0 support
  + hb-subset API and harfbuzz-subset ABI now declared stable
  + hb-style API is now stable</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636200000">- harfbuzz 3.1.0:
  * Better offset-overflow handling in the subsetter library
  * Improved Unicode 14 properties in the USE shaper, and various
    other USE shaper fixes
  * MATH and COLR v1 tables subsetting support, and various other
    subsetter fixes
  * Support for Pwo Karen / Ason Chin medial la. (Simon Cozens)
  * Apply GPOS positioning when substituting with morx table, if
    kerx is missing
  * Apply calt and clig features across syllable boundaries in
    Indic shaper
  * Meson option for enabling Graphite 2 has been renamed to
    graphite2
  * Build and documentation fixes
- add harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636459200">- Update to version 3.1.1:
  + Work around GCC cast-align error/warning on some platforms.
  + Documentation improvements.
- Drop patch fixed upstream:
  + harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1639742400">- Update to 3.1.2:
  + hb-shape / hb-view: revert treating text on the commandline as
    single paragraph (was introduced in 3.0.0); add new
  - -single-par to do that
  + Subsetter bug fixes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1639742401">- Update to 3.2.0:
  + Fixed shaping of Apple Color Emoji flags in right-to-left context
  + Fixed positioning of CFF fonts in HB_TINY profile
  + OpenType 1.9 language tags update
  + Add HB_NO_VERTICAL config option
  + Add HB_CONFIG_OVERRIDE_H for easier configuration
  + Improved packing of cmap, loca, and Ligature tables
  + Significantly improved overflow-resolution strategy in the repacker</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1644235200">- update to 3.3.2:
  + Revert splitting of pair positioning values introduced in 3.3.0
    as it proved problematic
- includes changes from 3.3.1:
  + Fix heap-use-after-free in harfbuzz-subset introduced in
    previous release
- includes changes from 3.3.0:
  + Improved documentation, code cleanup
  + The low 16-bits of face index will be used by hb_face_create()
    to select a face inside a font collection file format, while the
    high 16-bits will be used by hb_font_create() to load the named
    instance
  + Glyph positions and other font metrics now apply synthetic slant
    set by hb_font_set_synthetic_slant(), for improved positioning
    for synthetically slanted fonts
  + Fixed unintentional locale dependency in hb_variation_to_string()
    for decimal point representation
  + When applying pair positioning (kerning) the positioning value
    is split between the two sides of the pair for improved cursor
    positioning between such pairs
  + Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in
    conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing
    re-shaping during line breaking. Check the documentation for
    further details
  + Improved handling of macrolanguages when mapping BCP 47 codes
    to OpenType tags</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1644753600">- update to 3.4.0:
  + Perform sanity checks on shaping results is now part of
    “harfbuzz” library and can be enabled by setting the buffer
    flag HB_BUFFER_FLAG_VERIFY
  + Arabic Mark Transient Reordering Algorithm have been updated
    to revision 6
  + ISO 15924 code for mathematical notation, ‘Zmth’, now maps to
    the OpenType ‘math’ tag
  + It is now possible to get at once all math kerning values for a
    given glyph at a given corner
  + Fix locale_t portability issues on systems the typedef’s it to
    a void pointer</changelog>
  <changelog author="mgorse@suse.com" date="1658836800">- Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents
  (boo#1200900 CVE-2022-33068).</changelog>
  <changelog author="mgorse@suse.com" date="1680696000">- Add CVE-2023-25193.patch: limit how far we skip when looking
  back (bsc#1207922 CVE-2023-25193).</changelog>
</package>
<package pkgid="66c3f4ab064d3e5b9a8c9584c1d7151758acf3280413ee703f19d4eefda02474" name="libharfbuzz0" arch="x86_64">
  <version epoch="0" ver="3.4.0" rel="150400.3.8.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1591185600">- Update to version 2.6.7:
  + Update to Unicode 13.0.0
  + Fix hb_ot_layout_get_ligature_carets for fonts without lcar
    table
- includes fixes from 2.6.6:
  * A fix in AAT kerning for Geeza Pro</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1592913600">- update to 2.6.8:
  + New API to fetch glyph alternates from GSUB table
  + New API +hb_ot_layout_lookup_get_glyph_alternates()
- Drop gpg2 BuildRequires and stop verifying signature during
  build: upstream no longer signs the tarball/signature.</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- Update to version 2.7.2:
  + Fix a regression in the previous release that caused a crash
    with Kaithi.
  + More OOM fixes.
  + ot-funcs now handles variable empty glyphs better when
    hvar/vvar isn't present.
  + Reverted a GDEF processing regression.
  + A couple of fixes to handle OOM better.
  + Use an implementation for round that always rounds up, some
    minor fluctuations are expected on var font specially when
    hb-ot callback is used.
  + Fix an AAT's `kerx` issue on broken rendering of Devanagari
    Sangam MN.
  + Remove AAT's `lcar` table support from _get_ligature_carets
    API, not even much use on macOS installed fonts (only two
    files). GDEF support is the recommended one and expected to
    work properly after issues fixed two releases ago.
  - Minor memory fixes to handle OOM better specially in hb-ft.
  - Minor .so files versioning scheme change and remove
    stable/unstable scheme differences, was never used in practice
    (always default to stable scheme).
  - We are now suggesting careful packaging of the library using
    meson, https://github.com/harfbuzz/harfbuzz/wiki/Notes-on-migration-to-meson
    for more information.
  - Distribution package URL is changed, either use GitHub
    generated tarballs,
    `https://github.com/harfbuzz/harfbuzz/archive/$pkgver.tar.gz`
    or, even more preferably use commit hash of the release and git
    checkouts like,
    `git+https://github.com/harfbuzz/harfbuzz#commit=$commit`</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1609070400">- Update to version 2.7.4:
  + Fix missing --enable-introspection configure option
- Changes from version 2.7.3:
  + Update USE shaper to 2020-08-13 specification, and other
    improvements
  + Don’t disable liga feature in myanmar shaper, to match
    Uniscribe
  + Improvements to language and script tags handling.
  + Update language system tag registry to OpenType 1.8.4
  + Support for serializing and deserializing Unicode buffers
  + Increase buffer work limits to handle fonts with many complex
    lookups
  + Handle more shaping operations in trace output
  + Memory access fixes
  + More OOM fixes
  + Improved documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610107200">- Switch to meson buildsystem:
  + Add meson BuildRequires and macros.
  + Replace gcc-c++ for generic c++_compiler BuildRequires.
  + Add meson_test macro in check section, run tests during build.
  + Drop pkgconfig(graphite2) BuildRequires: No longer build
    graphite2 support, following upstream that disables this by
    default.
  + Stop packaging gtk-docs, pass -Ddocs=disabled to meson, this
    way we might avoid a build-cycle and since we did not have a
    explicit docs subpackage, just silently drop them.</changelog>
  <changelog author="dimstar@opensuse.org" date="1610539200">- Re-enable graphite2 support: TexLive relies on this to be
  present:
  + Pass -Dgraphite=enabled to meson.
  + Add pkgconfig(graphite2) BuildRequires.</changelog>
  <changelog author="christophe@krop.fr" date="1618315200">- Update to version 2.8.0:
  + Shape joining scripts other than Arabic/Syriac using the
    Universal Shaping Engine. Previously these were shaped using
    the generalized Arabic shaper.
  + Fix regression in shaping of U+0B55 ORIYA SIGN OVERLINE.
  + Update language tags.
  + Variations: reduce error: do not round each interpolated delta.
  + Documentation improvements.
  + Subsetter improvements: subsets most, if not all, lookup types
    now.
  + Fuzzer-found fixes and other improvements when memory failures
    happen.
  + Removed most atomic implementations now that we have C++11
    atomic impl.
  + General codebase upkeep; using more C++11 features: constexpr
    constructors, etc.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1620302400">- Update to version 2.8.1:
  + Subsetter now fully supports GSUB/GPOS/GDEF tables (including
    variations); as such, layout tables are retained by subsetter
    by default
  + hb-view supports iTerm2 and kitty inline image protocols
    it can also use Chafa for terminal graphics if available
- Add  pkgconfig(chafa): new, optional depdency.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1626264000">- Update to version 2.8.2:
  + Shaping LTR digits for RTL scripts now makes the native
    direction of the digits LTR, applying shaping and positioning
    rules on the same glyph order as Uniscribe
  + Subsetting COLR v1 and CPAL tables is now supported
  + Various fixes and improvements to the subsetter
  + When applying morx table, mark glyph widths should not be zeroed
  + GPOS is preferred over kerx, if GSUB was applied
  + Regional_Indicator pairs are grouped together when clustering</changelog>
  <changelog author="dimstar@opensuse.org" date="1626523200">- Drop pkgconfig(chafa) BuildRequires for now: causes a cycle
  between chafa and harfbuzz, and disable it in meson</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1631448000">- harfbuzz 2.9.1:
  + Subsetter API close to stable
  + Various fuzzer-found bug fixes
  + hb_buffer_append() now handles the pre- and post-context which
    previously were left unchanged in the destination buffer
  + hb-view / hb-shape now accept following new arguments:
  - -unicodes: takes a list of hex numbers that represent Unicode
    codepoints.
  + Undeprecated API: hb_set_invert()
- includes changes from 2.9.0:
  + Support multiple variation axes with same tag, aka HOI
  + The coretext testing shaper now passes font variations to
    CoreText
  + hb-shape/hb-view does not break line at new lines unless text
    is read from file
  + hb-view and hb-subset has a --batch now, similar to hb-shape
  + The --batch mode now uses ; as argument separator instead of :
    used previously
  + The --batch in hb-shape does not expect 0th argument anymore.
    That is, the lines read are interpreted as argv[1:], instead
    of argv[0:].
  + The --batch option has been undocumented. We are ready to
    document it; send feedback if you find it useful
  + hb-subset got arguments revamps. Added much-requested
  - -gids-file, --glyphs, --glyphs-file, --unicodes-file,
    supporting ranges in --unicodes.
  + Various bug fixes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1631966400">- harfbuzz 3.0.0:
  + Unicode 14.0 support
  + hb-subset API and harfbuzz-subset ABI now declared stable
  + hb-style API is now stable</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636200000">- harfbuzz 3.1.0:
  * Better offset-overflow handling in the subsetter library
  * Improved Unicode 14 properties in the USE shaper, and various
    other USE shaper fixes
  * MATH and COLR v1 tables subsetting support, and various other
    subsetter fixes
  * Support for Pwo Karen / Ason Chin medial la. (Simon Cozens)
  * Apply GPOS positioning when substituting with morx table, if
    kerx is missing
  * Apply calt and clig features across syllable boundaries in
    Indic shaper
  * Meson option for enabling Graphite 2 has been renamed to
    graphite2
  * Build and documentation fixes
- add harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636459200">- Update to version 3.1.1:
  + Work around GCC cast-align error/warning on some platforms.
  + Documentation improvements.
- Drop patch fixed upstream:
  + harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1639742400">- Update to 3.1.2:
  + hb-shape / hb-view: revert treating text on the commandline as
    single paragraph (was introduced in 3.0.0); add new
  - -single-par to do that
  + Subsetter bug fixes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1639742401">- Update to 3.2.0:
  + Fixed shaping of Apple Color Emoji flags in right-to-left context
  + Fixed positioning of CFF fonts in HB_TINY profile
  + OpenType 1.9 language tags update
  + Add HB_NO_VERTICAL config option
  + Add HB_CONFIG_OVERRIDE_H for easier configuration
  + Improved packing of cmap, loca, and Ligature tables
  + Significantly improved overflow-resolution strategy in the repacker</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1644235200">- update to 3.3.2:
  + Revert splitting of pair positioning values introduced in 3.3.0
    as it proved problematic
- includes changes from 3.3.1:
  + Fix heap-use-after-free in harfbuzz-subset introduced in
    previous release
- includes changes from 3.3.0:
  + Improved documentation, code cleanup
  + The low 16-bits of face index will be used by hb_face_create()
    to select a face inside a font collection file format, while the
    high 16-bits will be used by hb_font_create() to load the named
    instance
  + Glyph positions and other font metrics now apply synthetic slant
    set by hb_font_set_synthetic_slant(), for improved positioning
    for synthetically slanted fonts
  + Fixed unintentional locale dependency in hb_variation_to_string()
    for decimal point representation
  + When applying pair positioning (kerning) the positioning value
    is split between the two sides of the pair for improved cursor
    positioning between such pairs
  + Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in
    conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing
    re-shaping during line breaking. Check the documentation for
    further details
  + Improved handling of macrolanguages when mapping BCP 47 codes
    to OpenType tags</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1644753600">- update to 3.4.0:
  + Perform sanity checks on shaping results is now part of
    “harfbuzz” library and can be enabled by setting the buffer
    flag HB_BUFFER_FLAG_VERIFY
  + Arabic Mark Transient Reordering Algorithm have been updated
    to revision 6
  + ISO 15924 code for mathematical notation, ‘Zmth’, now maps to
    the OpenType ‘math’ tag
  + It is now possible to get at once all math kerning values for a
    given glyph at a given corner
  + Fix locale_t portability issues on systems the typedef’s it to
    a void pointer</changelog>
  <changelog author="mgorse@suse.com" date="1658836800">- Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents
  (boo#1200900 CVE-2022-33068).</changelog>
  <changelog author="mgorse@suse.com" date="1680696000">- Add CVE-2023-25193.patch: limit how far we skip when looking
  back (bsc#1207922 CVE-2023-25193).</changelog>
</package>
<package pkgid="640dc5537f46180fe10441a830a0d37ee0d6aed133909b55c348dc3170358784" name="libhidapi-hidraw0" arch="aarch64">
  <version epoch="0" ver="0.10.1" rel="150300.3.2.1"/>
  <changelog author="matwey.kornilov@gmail.com" date="1390824000">- Initial version</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1394798400">- Add do_not_install_docs.patch: don't let make install docs</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1395662400">- Supply LICENSE files with libraries</changelog>
  <changelog author="luca@z3ntu.xyz" date="1563796800">- Update to 0.9.0
- Switch upstream to libusb/hidapi because the original maintainer is not active anymore</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1563796801">- Use disabled services to follow Factory guidelines.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(libudev) instead of libudev-devel: allow
  OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="jgwang@suse.com" date="1610366400">- Update to version 0.10.1
  * Add FreeBSD/macOS/MinGW/Alpine/Arch Linux/Windows CI
  * Add hid_version/hid_version_str API (#192)
  * Add podspec to support releases via cocoapods
  * Add support for HID over I2C and uhid devices (#166)
  * Fix small casting issue
  * Fix race condition on device close (#189)
  * Fix API prototype for gcc flag -Wstrict-prototypes (#207)
  * Fix strict typecast (#206)
  * Fix -Wall -Wextra -pedantic -Werror compilation (#214) ￼…
  * Drop workaround for kernel &lt; 2.6.34
  * Use pkg-config to find libusb on *freebsd
  * Reattach kernel driver in hidapi-libusb
  * Move local variable declaration to the beginning of the function</changelog>
</package>
<package pkgid="a2f8d85938caba5b11b24866bd2abe5412d2638fd18033be6fa4776712d3b1fe" name="libhidapi-hidraw0" arch="s390x">
  <version epoch="0" ver="0.10.1" rel="150300.3.2.1"/>
  <changelog author="matwey.kornilov@gmail.com" date="1390824000">- Initial version</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1394798400">- Add do_not_install_docs.patch: don't let make install docs</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1395662400">- Supply LICENSE files with libraries</changelog>
  <changelog author="luca@z3ntu.xyz" date="1563796800">- Update to 0.9.0
- Switch upstream to libusb/hidapi because the original maintainer is not active anymore</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1563796801">- Use disabled services to follow Factory guidelines.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(libudev) instead of libudev-devel: allow
  OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="jgwang@suse.com" date="1610366400">- Update to version 0.10.1
  * Add FreeBSD/macOS/MinGW/Alpine/Arch Linux/Windows CI
  * Add hid_version/hid_version_str API (#192)
  * Add podspec to support releases via cocoapods
  * Add support for HID over I2C and uhid devices (#166)
  * Fix small casting issue
  * Fix race condition on device close (#189)
  * Fix API prototype for gcc flag -Wstrict-prototypes (#207)
  * Fix strict typecast (#206)
  * Fix -Wall -Wextra -pedantic -Werror compilation (#214) ￼…
  * Drop workaround for kernel &lt; 2.6.34
  * Use pkg-config to find libusb on *freebsd
  * Reattach kernel driver in hidapi-libusb
  * Move local variable declaration to the beginning of the function</changelog>
</package>
<package pkgid="15574cf563aa7c442ba4f7f4d11f7f53e092ed3792de808ad7cb239e0d34fb95" name="libhidapi-hidraw0" arch="x86_64">
  <version epoch="0" ver="0.10.1" rel="150300.3.2.1"/>
  <changelog author="matwey.kornilov@gmail.com" date="1390824000">- Initial version</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1394798400">- Add do_not_install_docs.patch: don't let make install docs</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1395662400">- Supply LICENSE files with libraries</changelog>
  <changelog author="luca@z3ntu.xyz" date="1563796800">- Update to 0.9.0
- Switch upstream to libusb/hidapi because the original maintainer is not active anymore</changelog>
  <changelog author="matwey.kornilov@gmail.com" date="1563796801">- Use disabled services to follow Factory guidelines.</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(libudev) instead of libudev-devel: allow
  OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="jgwang@suse.com" date="1610366400">- Update to version 0.10.1
  * Add FreeBSD/macOS/MinGW/Alpine/Arch Linux/Windows CI
  * Add hid_version/hid_version_str API (#192)
  * Add podspec to support releases via cocoapods
  * Add support for HID over I2C and uhid devices (#166)
  * Fix small casting issue
  * Fix race condition on device close (#189)
  * Fix API prototype for gcc flag -Wstrict-prototypes (#207)
  * Fix strict typecast (#206)
  * Fix -Wall -Wextra -pedantic -Werror compilation (#214) ￼…
  * Drop workaround for kernel &lt; 2.6.34
  * Use pkg-config to find libusb on *freebsd
  * Reattach kernel driver in hidapi-libusb
  * Move local variable declaration to the beginning of the function</changelog>
</package>
<package pkgid="9fa4d108db22e8d288e0dcb12ab14713f39c024258c10f435557b8c94a925a42" name="libnghttp2-14" arch="aarch64">
  <version epoch="0" ver="1.40.0" rel="150200.12.1"/>
  <changelog author="mpluskal@suse.com" date="1515153600">- Update to version 1.29.0:
  * lib: Use NGHTTP2_REFUSED_STREAM for streams which are closed by
    GOAWAY
  * build: Remove SPDY
  * build: Fix CMAKE_MODULE_PATH
  * nghttpx: Revert "nghttpx: Use an existing h2 backend connection
    as much as possible"
  * nghttpx: Write API request body in temporary file
  * nghttpx: Increase api-max-request-body
  * nghttpx: Faster configuration loading with lots of backends
  * nghttpx: Fix crash with --backend-http-proxy-uri option</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="tchvatal@suse.com" date="1523275200">- Drop spdylay dependency as it is deprecated since version 1.28.0
  and removed from cofnigure.ac since 1.29.0</changelog>
  <changelog author="tchvatal@suse.com" date="1523275201">- Version update to 1.31.0:
  * lib: Add nghttp2_session_set_user_data() public API function (GH-1137)
  * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128)
  * nghttpx: Close listening socket on graceful shutdown
  * nghttpx: Add an option to accept expired client certificate (GH-1126)
  * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123)
  * nghttpx: Fix potential memory leak
  * lib: Allow PING frame to be sent after GOAWAY (GH-1103)
  * nghttpx: Fix bug that h1 backend idle timeout expires sooner
  * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119)
  * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099)
  * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094)
  * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101)</changelog>
  <changelog author="tchvatal@suse.com" date="1523620800">- Version umpdate to 1.31.1:
  * Fix bsc#1088639 CVE-2018-1000168
  * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/</changelog>
  <changelog author="mpluskal@suse.com" date="1531137600">- Update to version 1.32.0:
  * lib: Ignore all input after calling session_terminate_session
  * lib: Fix treatment of padding
  * lib: Don't allow 101 HTTP status code because HTTP/2 removes
    HTTP Upgrade
  * build: add ENABLE_STATIC_LIB option to build static lib
  * third-party: Upgrade neverbleed to the latest master
  * asio: Support client side SNI
  * src: Compile with libressl 2.7.2
  * src: Allow building without NPN
  * h2load: -r and --duration are mutually exclusive</changelog>
  <changelog author="adam.majer@suse.de" date="1537963200">- Update to version 1.33.0:
  * lib: Tweak nghttp2_session_set_stream_user_data
  * lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS.
  * lib: Implement ORIGIN frame
  * asio: support definition of local endpoint for cleartext
    client session
  * integration: Remove remaining SPDY code from the integration tests
  * nghttpx: Fix worker process crash with neverbleed write error
  * nghttpx: Support per-backend mruby script
  * nghttpx: Fix stream reset if data from client is arrived before
    dconn is attached</changelog>
  <changelog author="adam.majer@suse.de" date="1539000000">- Update to version 1.34.0: (bsc#1112438, FATE#326776)
  * lib: Implement RFC 8441 :protocol support
  * nghttpx: Add read/write-timeout parameters to backend option
  * nghttpx: Fix mruby parameter validation in backend option
  * nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2
  * nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues
  * nghttpx: Update mruby 1.4.1
  * nghttpx: Add mruby env.tls_handshake_finished
  * nghttpx: Add --tls13-ciphers and --tls-client-ciphers options
  * nghttpx: Add RFC 8470 Early-Data header field support
  * nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support</changelog>
  <changelog author="mpluskal@suse.com" date="1547208000">- Update to version 1.35.1:
  * nghttpx: Fix broken trailing slash handling (GH-1276)
- Changes for version 1.35:
  * build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238)
  * lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222)
  * src: Require C++14 language feature
  * nghttpx: Write mruby send_info early
  * nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend
  * h2load: Handle HTTP/1 non-final response (GH-1259)
  * h2load: Clarify that time for connect includes TLS handshake</changelog>
  <changelog author="tchvatal@suse.com" date="1547812800">- Use multibuild to not pull in python3 in first build, nghttp2
  is low in the system</changelog>
  <changelog author="seanlew@opensuse.org" date="1547812801">- Update to 1.36.0
  * build: disable shared library if ENABLE_SHARED_LIB is off
  * third-party: use http-parser to v2.9.0 (GH-1294)
  * third-party: Update mruby to 2.0.0
  * nghttpx: Pool h1 backend connection per address (GH-1292)
  * nghttpx: Randomize backend address round robin order per thread
    (GH-1291)
  * nghttpx: Fix getting long SNs for openssl &lt; 1.1 (GH-1287)
  * h2load: add an option to write per-request logs (GH-1256)
  * asio: added access to # of the current server port (GH-1257)</changelog>
  <changelog author="tchvatal@suse.com" date="1557489600">- Update to 1.38.0:
  * This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry.
  * It also fixes the bug that HTTP/1.1 chunked request stalls.
  * Now nghttpx does not log authorization request header field value with -LINFO.
  * This release fixes possible backend stall when header and request body are sent in their own packets.
  * The backend option gets weight parameter to influence backend selection.
  * This release fixes compile error with BoringSSL.
- Add patch from upstream to build with new boost bsc#1134616:
  * boost170.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1565697600">- Update to version 1.39.1:
  * This release fixes the bug that log-level is not set with
    cmd-line or configuration file. It also fixes FPE with default
    backend.
- Changes for version 1.39.0:
  * libnghttp2 now ignores content-length in 200 response to
    CONNECT request as per RFC 7230.
  * mruby has been upgraded to 2.0.1.
  * libnghttp2-asio now supports boost-1.70.
  * http-parser has been replaced with llhttp.
  * nghttpx now ignores Content-Length and Transfer-Encoding in 1xx
    or 200 to CONNECT.
- Drop no longer needed boost170.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1566216000">- Update to version 1.39.2 (bsc#1146184, bsc#1146182):
  * This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513
  “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2
  frames cause Denial of Service by consuming CPU time. Check out
  https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
  for details. For nghttpx, additionally limiting inbound traffic by
  - -read-rate and --read-burst options is quite effective against
  this kind of attack.
  * Add nghttp2_option_set_max_outbound_ack API function
  * nghttpx: Fix request stall</changelog>
  <changelog author="mpluskal@suse.com" date="1566216001">- Require correct library from devel package - boo#1125689</changelog>
  <changelog author="mpluskal@suse.com" date="1567166400">- Conditionally remove dependecy on jemalloc for SLE-12</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579003200">- Update to version 1.40.0 to fix CVE-2019-18802 in envoy-proxy and
  cilium-proxy (bsc#1166481)
  * lib: Add nghttp2_check_authority as public API
  * lib: Fix the bug that stream is closed with wrong error code
  * lib: Faster huffman encoding and decoding
  * build: Avoid filename collision of static and dynamic lib
  * build: Add new flag ENABLE_STATIC_CRT for Windows
  * build: cmake: Support building nghttpx with systemd
  * third-party: Update neverbleed to fix memory leak
  * nghttpx: Fix bug that mruby is incorrectly shared between
    backends
  * nghttpx: Reconnect h1 backend if it lost connection before
    sending headers
  * nghttpx: Returns 408 if backend timed out before sending
    headers
  * nghttpx: Fix request stal</changelog>
  <changelog author="pgajdos@suse.com" date="1615550400">- security update
- added patches
  fix CVE-2020-11080 [bsc#1181358], HTTP/2 Large Settings Frame DoS
  + nghttp2-CVE-2020-11080.patch</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1695729600">- Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be
  sent, and nghttp2_on_stream_close_callback fails with a fatal error.
  [CVE-2023-35945 bsc#1215713]
  + nghttp2-CVE-2023-35945.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1697716800">- security update
- added patches
  fix CVE-2023-44487 [bsc#1216123], HTTP/2 Rapid Reset Attack
  + nghttp2-CVE-2023-44487.patch</changelog>
</package>
<package pkgid="e1a8df7b3ff89df83cb20ad50618c53e82016a8962f203e267a7f406dc61b87b" name="libnghttp2-14" arch="s390x">
  <version epoch="0" ver="1.40.0" rel="150200.12.1"/>
  <changelog author="mpluskal@suse.com" date="1515153600">- Update to version 1.29.0:
  * lib: Use NGHTTP2_REFUSED_STREAM for streams which are closed by
    GOAWAY
  * build: Remove SPDY
  * build: Fix CMAKE_MODULE_PATH
  * nghttpx: Revert "nghttpx: Use an existing h2 backend connection
    as much as possible"
  * nghttpx: Write API request body in temporary file
  * nghttpx: Increase api-max-request-body
  * nghttpx: Faster configuration loading with lots of backends
  * nghttpx: Fix crash with --backend-http-proxy-uri option</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="tchvatal@suse.com" date="1523275200">- Drop spdylay dependency as it is deprecated since version 1.28.0
  and removed from cofnigure.ac since 1.29.0</changelog>
  <changelog author="tchvatal@suse.com" date="1523275201">- Version update to 1.31.0:
  * lib: Add nghttp2_session_set_user_data() public API function (GH-1137)
  * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128)
  * nghttpx: Close listening socket on graceful shutdown
  * nghttpx: Add an option to accept expired client certificate (GH-1126)
  * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123)
  * nghttpx: Fix potential memory leak
  * lib: Allow PING frame to be sent after GOAWAY (GH-1103)
  * nghttpx: Fix bug that h1 backend idle timeout expires sooner
  * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119)
  * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099)
  * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094)
  * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101)</changelog>
  <changelog author="tchvatal@suse.com" date="1523620800">- Version umpdate to 1.31.1:
  * Fix bsc#1088639 CVE-2018-1000168
  * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/</changelog>
  <changelog author="mpluskal@suse.com" date="1531137600">- Update to version 1.32.0:
  * lib: Ignore all input after calling session_terminate_session
  * lib: Fix treatment of padding
  * lib: Don't allow 101 HTTP status code because HTTP/2 removes
    HTTP Upgrade
  * build: add ENABLE_STATIC_LIB option to build static lib
  * third-party: Upgrade neverbleed to the latest master
  * asio: Support client side SNI
  * src: Compile with libressl 2.7.2
  * src: Allow building without NPN
  * h2load: -r and --duration are mutually exclusive</changelog>
  <changelog author="adam.majer@suse.de" date="1537963200">- Update to version 1.33.0:
  * lib: Tweak nghttp2_session_set_stream_user_data
  * lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS.
  * lib: Implement ORIGIN frame
  * asio: support definition of local endpoint for cleartext
    client session
  * integration: Remove remaining SPDY code from the integration tests
  * nghttpx: Fix worker process crash with neverbleed write error
  * nghttpx: Support per-backend mruby script
  * nghttpx: Fix stream reset if data from client is arrived before
    dconn is attached</changelog>
  <changelog author="adam.majer@suse.de" date="1539000000">- Update to version 1.34.0: (bsc#1112438, FATE#326776)
  * lib: Implement RFC 8441 :protocol support
  * nghttpx: Add read/write-timeout parameters to backend option
  * nghttpx: Fix mruby parameter validation in backend option
  * nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2
  * nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues
  * nghttpx: Update mruby 1.4.1
  * nghttpx: Add mruby env.tls_handshake_finished
  * nghttpx: Add --tls13-ciphers and --tls-client-ciphers options
  * nghttpx: Add RFC 8470 Early-Data header field support
  * nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support</changelog>
  <changelog author="mpluskal@suse.com" date="1547208000">- Update to version 1.35.1:
  * nghttpx: Fix broken trailing slash handling (GH-1276)
- Changes for version 1.35:
  * build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238)
  * lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222)
  * src: Require C++14 language feature
  * nghttpx: Write mruby send_info early
  * nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend
  * h2load: Handle HTTP/1 non-final response (GH-1259)
  * h2load: Clarify that time for connect includes TLS handshake</changelog>
  <changelog author="tchvatal@suse.com" date="1547812800">- Use multibuild to not pull in python3 in first build, nghttp2
  is low in the system</changelog>
  <changelog author="seanlew@opensuse.org" date="1547812801">- Update to 1.36.0
  * build: disable shared library if ENABLE_SHARED_LIB is off
  * third-party: use http-parser to v2.9.0 (GH-1294)
  * third-party: Update mruby to 2.0.0
  * nghttpx: Pool h1 backend connection per address (GH-1292)
  * nghttpx: Randomize backend address round robin order per thread
    (GH-1291)
  * nghttpx: Fix getting long SNs for openssl &lt; 1.1 (GH-1287)
  * h2load: add an option to write per-request logs (GH-1256)
  * asio: added access to # of the current server port (GH-1257)</changelog>
  <changelog author="tchvatal@suse.com" date="1557489600">- Update to 1.38.0:
  * This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry.
  * It also fixes the bug that HTTP/1.1 chunked request stalls.
  * Now nghttpx does not log authorization request header field value with -LINFO.
  * This release fixes possible backend stall when header and request body are sent in their own packets.
  * The backend option gets weight parameter to influence backend selection.
  * This release fixes compile error with BoringSSL.
- Add patch from upstream to build with new boost bsc#1134616:
  * boost170.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1565697600">- Update to version 1.39.1:
  * This release fixes the bug that log-level is not set with
    cmd-line or configuration file. It also fixes FPE with default
    backend.
- Changes for version 1.39.0:
  * libnghttp2 now ignores content-length in 200 response to
    CONNECT request as per RFC 7230.
  * mruby has been upgraded to 2.0.1.
  * libnghttp2-asio now supports boost-1.70.
  * http-parser has been replaced with llhttp.
  * nghttpx now ignores Content-Length and Transfer-Encoding in 1xx
    or 200 to CONNECT.
- Drop no longer needed boost170.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1566216000">- Update to version 1.39.2 (bsc#1146184, bsc#1146182):
  * This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513
  “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2
  frames cause Denial of Service by consuming CPU time. Check out
  https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
  for details. For nghttpx, additionally limiting inbound traffic by
  - -read-rate and --read-burst options is quite effective against
  this kind of attack.
  * Add nghttp2_option_set_max_outbound_ack API function
  * nghttpx: Fix request stall</changelog>
  <changelog author="mpluskal@suse.com" date="1566216001">- Require correct library from devel package - boo#1125689</changelog>
  <changelog author="mpluskal@suse.com" date="1567166400">- Conditionally remove dependecy on jemalloc for SLE-12</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579003200">- Update to version 1.40.0 to fix CVE-2019-18802 in envoy-proxy and
  cilium-proxy (bsc#1166481)
  * lib: Add nghttp2_check_authority as public API
  * lib: Fix the bug that stream is closed with wrong error code
  * lib: Faster huffman encoding and decoding
  * build: Avoid filename collision of static and dynamic lib
  * build: Add new flag ENABLE_STATIC_CRT for Windows
  * build: cmake: Support building nghttpx with systemd
  * third-party: Update neverbleed to fix memory leak
  * nghttpx: Fix bug that mruby is incorrectly shared between
    backends
  * nghttpx: Reconnect h1 backend if it lost connection before
    sending headers
  * nghttpx: Returns 408 if backend timed out before sending
    headers
  * nghttpx: Fix request stal</changelog>
  <changelog author="pgajdos@suse.com" date="1615550400">- security update
- added patches
  fix CVE-2020-11080 [bsc#1181358], HTTP/2 Large Settings Frame DoS
  + nghttp2-CVE-2020-11080.patch</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1695729600">- Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be
  sent, and nghttp2_on_stream_close_callback fails with a fatal error.
  [CVE-2023-35945 bsc#1215713]
  + nghttp2-CVE-2023-35945.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1697716800">- security update
- added patches
  fix CVE-2023-44487 [bsc#1216123], HTTP/2 Rapid Reset Attack
  + nghttp2-CVE-2023-44487.patch</changelog>
</package>
<package pkgid="6625e233bc93d47e048dfc9d7a6df96a473a542f95815dae87f5c0db80dd532c" name="libnghttp2-14" arch="x86_64">
  <version epoch="0" ver="1.40.0" rel="150200.12.1"/>
  <changelog author="mpluskal@suse.com" date="1515153600">- Update to version 1.29.0:
  * lib: Use NGHTTP2_REFUSED_STREAM for streams which are closed by
    GOAWAY
  * build: Remove SPDY
  * build: Fix CMAKE_MODULE_PATH
  * nghttpx: Revert "nghttpx: Use an existing h2 backend connection
    as much as possible"
  * nghttpx: Write API request body in temporary file
  * nghttpx: Increase api-max-request-body
  * nghttpx: Faster configuration loading with lots of backends
  * nghttpx: Fix crash with --backend-http-proxy-uri option</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="tchvatal@suse.com" date="1523275200">- Drop spdylay dependency as it is deprecated since version 1.28.0
  and removed from cofnigure.ac since 1.29.0</changelog>
  <changelog author="tchvatal@suse.com" date="1523275201">- Version update to 1.31.0:
  * lib: Add nghttp2_session_set_user_data() public API function (GH-1137)
  * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128)
  * nghttpx: Close listening socket on graceful shutdown
  * nghttpx: Add an option to accept expired client certificate (GH-1126)
  * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123)
  * nghttpx: Fix potential memory leak
  * lib: Allow PING frame to be sent after GOAWAY (GH-1103)
  * nghttpx: Fix bug that h1 backend idle timeout expires sooner
  * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119)
  * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099)
  * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094)
  * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101)</changelog>
  <changelog author="tchvatal@suse.com" date="1523620800">- Version umpdate to 1.31.1:
  * Fix bsc#1088639 CVE-2018-1000168
  * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/</changelog>
  <changelog author="mpluskal@suse.com" date="1531137600">- Update to version 1.32.0:
  * lib: Ignore all input after calling session_terminate_session
  * lib: Fix treatment of padding
  * lib: Don't allow 101 HTTP status code because HTTP/2 removes
    HTTP Upgrade
  * build: add ENABLE_STATIC_LIB option to build static lib
  * third-party: Upgrade neverbleed to the latest master
  * asio: Support client side SNI
  * src: Compile with libressl 2.7.2
  * src: Allow building without NPN
  * h2load: -r and --duration are mutually exclusive</changelog>
  <changelog author="adam.majer@suse.de" date="1537963200">- Update to version 1.33.0:
  * lib: Tweak nghttp2_session_set_stream_user_data
  * lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS.
  * lib: Implement ORIGIN frame
  * asio: support definition of local endpoint for cleartext
    client session
  * integration: Remove remaining SPDY code from the integration tests
  * nghttpx: Fix worker process crash with neverbleed write error
  * nghttpx: Support per-backend mruby script
  * nghttpx: Fix stream reset if data from client is arrived before
    dconn is attached</changelog>
  <changelog author="adam.majer@suse.de" date="1539000000">- Update to version 1.34.0: (bsc#1112438, FATE#326776)
  * lib: Implement RFC 8441 :protocol support
  * nghttpx: Add read/write-timeout parameters to backend option
  * nghttpx: Fix mruby parameter validation in backend option
  * nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2
  * nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues
  * nghttpx: Update mruby 1.4.1
  * nghttpx: Add mruby env.tls_handshake_finished
  * nghttpx: Add --tls13-ciphers and --tls-client-ciphers options
  * nghttpx: Add RFC 8470 Early-Data header field support
  * nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support</changelog>
  <changelog author="mpluskal@suse.com" date="1547208000">- Update to version 1.35.1:
  * nghttpx: Fix broken trailing slash handling (GH-1276)
- Changes for version 1.35:
  * build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238)
  * lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222)
  * src: Require C++14 language feature
  * nghttpx: Write mruby send_info early
  * nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend
  * h2load: Handle HTTP/1 non-final response (GH-1259)
  * h2load: Clarify that time for connect includes TLS handshake</changelog>
  <changelog author="tchvatal@suse.com" date="1547812800">- Use multibuild to not pull in python3 in first build, nghttp2
  is low in the system</changelog>
  <changelog author="seanlew@opensuse.org" date="1547812801">- Update to 1.36.0
  * build: disable shared library if ENABLE_SHARED_LIB is off
  * third-party: use http-parser to v2.9.0 (GH-1294)
  * third-party: Update mruby to 2.0.0
  * nghttpx: Pool h1 backend connection per address (GH-1292)
  * nghttpx: Randomize backend address round robin order per thread
    (GH-1291)
  * nghttpx: Fix getting long SNs for openssl &lt; 1.1 (GH-1287)
  * h2load: add an option to write per-request logs (GH-1256)
  * asio: added access to # of the current server port (GH-1257)</changelog>
  <changelog author="tchvatal@suse.com" date="1557489600">- Update to 1.38.0:
  * This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry.
  * It also fixes the bug that HTTP/1.1 chunked request stalls.
  * Now nghttpx does not log authorization request header field value with -LINFO.
  * This release fixes possible backend stall when header and request body are sent in their own packets.
  * The backend option gets weight parameter to influence backend selection.
  * This release fixes compile error with BoringSSL.
- Add patch from upstream to build with new boost bsc#1134616:
  * boost170.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1565697600">- Update to version 1.39.1:
  * This release fixes the bug that log-level is not set with
    cmd-line or configuration file. It also fixes FPE with default
    backend.
- Changes for version 1.39.0:
  * libnghttp2 now ignores content-length in 200 response to
    CONNECT request as per RFC 7230.
  * mruby has been upgraded to 2.0.1.
  * libnghttp2-asio now supports boost-1.70.
  * http-parser has been replaced with llhttp.
  * nghttpx now ignores Content-Length and Transfer-Encoding in 1xx
    or 200 to CONNECT.
- Drop no longer needed boost170.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1566216000">- Update to version 1.39.2 (bsc#1146184, bsc#1146182):
  * This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513
  “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2
  frames cause Denial of Service by consuming CPU time. Check out
  https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
  for details. For nghttpx, additionally limiting inbound traffic by
  - -read-rate and --read-burst options is quite effective against
  this kind of attack.
  * Add nghttp2_option_set_max_outbound_ack API function
  * nghttpx: Fix request stall</changelog>
  <changelog author="mpluskal@suse.com" date="1566216001">- Require correct library from devel package - boo#1125689</changelog>
  <changelog author="mpluskal@suse.com" date="1567166400">- Conditionally remove dependecy on jemalloc for SLE-12</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579003200">- Update to version 1.40.0 to fix CVE-2019-18802 in envoy-proxy and
  cilium-proxy (bsc#1166481)
  * lib: Add nghttp2_check_authority as public API
  * lib: Fix the bug that stream is closed with wrong error code
  * lib: Faster huffman encoding and decoding
  * build: Avoid filename collision of static and dynamic lib
  * build: Add new flag ENABLE_STATIC_CRT for Windows
  * build: cmake: Support building nghttpx with systemd
  * third-party: Update neverbleed to fix memory leak
  * nghttpx: Fix bug that mruby is incorrectly shared between
    backends
  * nghttpx: Reconnect h1 backend if it lost connection before
    sending headers
  * nghttpx: Returns 408 if backend timed out before sending
    headers
  * nghttpx: Fix request stal</changelog>
  <changelog author="pgajdos@suse.com" date="1615550400">- security update
- added patches
  fix CVE-2020-11080 [bsc#1181358], HTTP/2 Large Settings Frame DoS
  + nghttp2-CVE-2020-11080.patch</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1695729600">- Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be
  sent, and nghttp2_on_stream_close_callback fails with a fatal error.
  [CVE-2023-35945 bsc#1215713]
  + nghttp2-CVE-2023-35945.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1697716800">- security update
- added patches
  fix CVE-2023-44487 [bsc#1216123], HTTP/2 Rapid Reset Attack
  + nghttp2-CVE-2023-44487.patch</changelog>
</package>
<package pkgid="b05ed6aeeddea15d818d13f733f8f9b67b2342608460f021cb3eea0d8802e83d" name="libnghttp2-14" arch="aarch64">
  <version epoch="0" ver="1.40.0" rel="150200.9.1"/>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Export PYTHON=/usr/bin/python3 before running configure: allow to
  build without (comnplete) python2 in the buildroot. In any case
  we only ship python3-bindings already.</changelog>
  <changelog author="mpluskal@suse.com" date="1515153600">- Update to version 1.29.0:
  * lib: Use NGHTTP2_REFUSED_STREAM for streams which are closed by
    GOAWAY
  * build: Remove SPDY
  * build: Fix CMAKE_MODULE_PATH
  * nghttpx: Revert "nghttpx: Use an existing h2 backend connection
    as much as possible"
  * nghttpx: Write API request body in temporary file
  * nghttpx: Increase api-max-request-body
  * nghttpx: Faster configuration loading with lots of backends
  * nghttpx: Fix crash with --backend-http-proxy-uri option</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="tchvatal@suse.com" date="1523275200">- Drop spdylay dependency as it is deprecated since version 1.28.0
  and removed from cofnigure.ac since 1.29.0</changelog>
  <changelog author="tchvatal@suse.com" date="1523275201">- Version update to 1.31.0:
  * lib: Add nghttp2_session_set_user_data() public API function (GH-1137)
  * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128)
  * nghttpx: Close listening socket on graceful shutdown
  * nghttpx: Add an option to accept expired client certificate (GH-1126)
  * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123)
  * nghttpx: Fix potential memory leak
  * lib: Allow PING frame to be sent after GOAWAY (GH-1103)
  * nghttpx: Fix bug that h1 backend idle timeout expires sooner
  * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119)
  * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099)
  * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094)
  * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101)</changelog>
  <changelog author="tchvatal@suse.com" date="1523620800">- Version umpdate to 1.31.1:
  * Fix bsc#1088639 CVE-2018-1000168
  * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/</changelog>
  <changelog author="mpluskal@suse.com" date="1531137600">- Update to version 1.32.0:
  * lib: Ignore all input after calling session_terminate_session
  * lib: Fix treatment of padding
  * lib: Don't allow 101 HTTP status code because HTTP/2 removes
    HTTP Upgrade
  * build: add ENABLE_STATIC_LIB option to build static lib
  * third-party: Upgrade neverbleed to the latest master
  * asio: Support client side SNI
  * src: Compile with libressl 2.7.2
  * src: Allow building without NPN
  * h2load: -r and --duration are mutually exclusive</changelog>
  <changelog author="adam.majer@suse.de" date="1537963200">- Update to version 1.33.0:
  * lib: Tweak nghttp2_session_set_stream_user_data
  * lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS.
  * lib: Implement ORIGIN frame
  * asio: support definition of local endpoint for cleartext
    client session
  * integration: Remove remaining SPDY code from the integration tests
  * nghttpx: Fix worker process crash with neverbleed write error
  * nghttpx: Support per-backend mruby script
  * nghttpx: Fix stream reset if data from client is arrived before
    dconn is attached</changelog>
  <changelog author="adam.majer@suse.de" date="1539000000">- Update to version 1.34.0: (bsc#1112438, FATE#326776)
  * lib: Implement RFC 8441 :protocol support
  * nghttpx: Add read/write-timeout parameters to backend option
  * nghttpx: Fix mruby parameter validation in backend option
  * nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2
  * nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues
  * nghttpx: Update mruby 1.4.1
  * nghttpx: Add mruby env.tls_handshake_finished
  * nghttpx: Add --tls13-ciphers and --tls-client-ciphers options
  * nghttpx: Add RFC 8470 Early-Data header field support
  * nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support</changelog>
  <changelog author="mpluskal@suse.com" date="1547208000">- Update to version 1.35.1:
  * nghttpx: Fix broken trailing slash handling (GH-1276)
- Changes for version 1.35:
  * build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238)
  * lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222)
  * src: Require C++14 language feature
  * nghttpx: Write mruby send_info early
  * nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend
  * h2load: Handle HTTP/1 non-final response (GH-1259)
  * h2load: Clarify that time for connect includes TLS handshake</changelog>
  <changelog author="tchvatal@suse.com" date="1547812800">- Use multibuild to not pull in python3 in first build, nghttp2
  is low in the system</changelog>
  <changelog author="seanlew@opensuse.org" date="1547812801">- Update to 1.36.0
  * build: disable shared library if ENABLE_SHARED_LIB is off
  * third-party: use http-parser to v2.9.0 (GH-1294)
  * third-party: Update mruby to 2.0.0
  * nghttpx: Pool h1 backend connection per address (GH-1292)
  * nghttpx: Randomize backend address round robin order per thread
    (GH-1291)
  * nghttpx: Fix getting long SNs for openssl &lt; 1.1 (GH-1287)
  * h2load: add an option to write per-request logs (GH-1256)
  * asio: added access to # of the current server port (GH-1257)</changelog>
  <changelog author="tchvatal@suse.com" date="1557489600">- Update to 1.38.0:
  * This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry.
  * It also fixes the bug that HTTP/1.1 chunked request stalls.
  * Now nghttpx does not log authorization request header field value with -LINFO.
  * This release fixes possible backend stall when header and request body are sent in their own packets.
  * The backend option gets weight parameter to influence backend selection.
  * This release fixes compile error with BoringSSL.
- Add patch from upstream to build with new boost bsc#1134616:
  * boost170.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1565697600">- Update to version 1.39.1:
  * This release fixes the bug that log-level is not set with
    cmd-line or configuration file. It also fixes FPE with default
    backend.
- Changes for version 1.39.0:
  * libnghttp2 now ignores content-length in 200 response to
    CONNECT request as per RFC 7230.
  * mruby has been upgraded to 2.0.1.
  * libnghttp2-asio now supports boost-1.70.
  * http-parser has been replaced with llhttp.
  * nghttpx now ignores Content-Length and Transfer-Encoding in 1xx
    or 200 to CONNECT.
- Drop no longer needed boost170.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1566216000">- Update to version 1.39.2 (bsc#1146184, bsc#1146182):
  * This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513
  “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2
  frames cause Denial of Service by consuming CPU time. Check out
  https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
  for details. For nghttpx, additionally limiting inbound traffic by
  - -read-rate and --read-burst options is quite effective against
  this kind of attack.
  * Add nghttp2_option_set_max_outbound_ack API function
  * nghttpx: Fix request stall</changelog>
  <changelog author="mpluskal@suse.com" date="1566216001">- Require correct library from devel package - boo#1125689</changelog>
  <changelog author="mpluskal@suse.com" date="1567166400">- Conditionally remove dependecy on jemalloc for SLE-12</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579003200">- Update to version 1.40.0 to fix CVE-2019-18802 in envoy-proxy and
  cilium-proxy (bsc#1166481)
  * lib: Add nghttp2_check_authority as public API
  * lib: Fix the bug that stream is closed with wrong error code
  * lib: Faster huffman encoding and decoding
  * build: Avoid filename collision of static and dynamic lib
  * build: Add new flag ENABLE_STATIC_CRT for Windows
  * build: cmake: Support building nghttpx with systemd
  * third-party: Update neverbleed to fix memory leak
  * nghttpx: Fix bug that mruby is incorrectly shared between
    backends
  * nghttpx: Reconnect h1 backend if it lost connection before
    sending headers
  * nghttpx: Returns 408 if backend timed out before sending
    headers
  * nghttpx: Fix request stal</changelog>
  <changelog author="pgajdos@suse.com" date="1615550400">- security update
- added patches
  fix CVE-2020-11080 [bsc#1181358], HTTP/2 Large Settings Frame DoS
  + nghttp2-CVE-2020-11080.patch</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1695729600">- Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be
  sent, and nghttp2_on_stream_close_callback fails with a fatal error.
  [CVE-2023-35945 bsc#1215713]
  + nghttp2-CVE-2023-35945.patch</changelog>
</package>
<package pkgid="412ca9a7dd0421ac72ca85359edc606782c9545efce85a35284f3631d3474f0e" name="libnghttp2-14" arch="s390x">
  <version epoch="0" ver="1.40.0" rel="150200.9.1"/>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Export PYTHON=/usr/bin/python3 before running configure: allow to
  build without (comnplete) python2 in the buildroot. In any case
  we only ship python3-bindings already.</changelog>
  <changelog author="mpluskal@suse.com" date="1515153600">- Update to version 1.29.0:
  * lib: Use NGHTTP2_REFUSED_STREAM for streams which are closed by
    GOAWAY
  * build: Remove SPDY
  * build: Fix CMAKE_MODULE_PATH
  * nghttpx: Revert "nghttpx: Use an existing h2 backend connection
    as much as possible"
  * nghttpx: Write API request body in temporary file
  * nghttpx: Increase api-max-request-body
  * nghttpx: Faster configuration loading with lots of backends
  * nghttpx: Fix crash with --backend-http-proxy-uri option</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="tchvatal@suse.com" date="1523275200">- Drop spdylay dependency as it is deprecated since version 1.28.0
  and removed from cofnigure.ac since 1.29.0</changelog>
  <changelog author="tchvatal@suse.com" date="1523275201">- Version update to 1.31.0:
  * lib: Add nghttp2_session_set_user_data() public API function (GH-1137)
  * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128)
  * nghttpx: Close listening socket on graceful shutdown
  * nghttpx: Add an option to accept expired client certificate (GH-1126)
  * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123)
  * nghttpx: Fix potential memory leak
  * lib: Allow PING frame to be sent after GOAWAY (GH-1103)
  * nghttpx: Fix bug that h1 backend idle timeout expires sooner
  * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119)
  * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099)
  * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094)
  * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101)</changelog>
  <changelog author="tchvatal@suse.com" date="1523620800">- Version umpdate to 1.31.1:
  * Fix bsc#1088639 CVE-2018-1000168
  * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/</changelog>
  <changelog author="mpluskal@suse.com" date="1531137600">- Update to version 1.32.0:
  * lib: Ignore all input after calling session_terminate_session
  * lib: Fix treatment of padding
  * lib: Don't allow 101 HTTP status code because HTTP/2 removes
    HTTP Upgrade
  * build: add ENABLE_STATIC_LIB option to build static lib
  * third-party: Upgrade neverbleed to the latest master
  * asio: Support client side SNI
  * src: Compile with libressl 2.7.2
  * src: Allow building without NPN
  * h2load: -r and --duration are mutually exclusive</changelog>
  <changelog author="adam.majer@suse.de" date="1537963200">- Update to version 1.33.0:
  * lib: Tweak nghttp2_session_set_stream_user_data
  * lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS.
  * lib: Implement ORIGIN frame
  * asio: support definition of local endpoint for cleartext
    client session
  * integration: Remove remaining SPDY code from the integration tests
  * nghttpx: Fix worker process crash with neverbleed write error
  * nghttpx: Support per-backend mruby script
  * nghttpx: Fix stream reset if data from client is arrived before
    dconn is attached</changelog>
  <changelog author="adam.majer@suse.de" date="1539000000">- Update to version 1.34.0: (bsc#1112438, FATE#326776)
  * lib: Implement RFC 8441 :protocol support
  * nghttpx: Add read/write-timeout parameters to backend option
  * nghttpx: Fix mruby parameter validation in backend option
  * nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2
  * nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues
  * nghttpx: Update mruby 1.4.1
  * nghttpx: Add mruby env.tls_handshake_finished
  * nghttpx: Add --tls13-ciphers and --tls-client-ciphers options
  * nghttpx: Add RFC 8470 Early-Data header field support
  * nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support</changelog>
  <changelog author="mpluskal@suse.com" date="1547208000">- Update to version 1.35.1:
  * nghttpx: Fix broken trailing slash handling (GH-1276)
- Changes for version 1.35:
  * build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238)
  * lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222)
  * src: Require C++14 language feature
  * nghttpx: Write mruby send_info early
  * nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend
  * h2load: Handle HTTP/1 non-final response (GH-1259)
  * h2load: Clarify that time for connect includes TLS handshake</changelog>
  <changelog author="tchvatal@suse.com" date="1547812800">- Use multibuild to not pull in python3 in first build, nghttp2
  is low in the system</changelog>
  <changelog author="seanlew@opensuse.org" date="1547812801">- Update to 1.36.0
  * build: disable shared library if ENABLE_SHARED_LIB is off
  * third-party: use http-parser to v2.9.0 (GH-1294)
  * third-party: Update mruby to 2.0.0
  * nghttpx: Pool h1 backend connection per address (GH-1292)
  * nghttpx: Randomize backend address round robin order per thread
    (GH-1291)
  * nghttpx: Fix getting long SNs for openssl &lt; 1.1 (GH-1287)
  * h2load: add an option to write per-request logs (GH-1256)
  * asio: added access to # of the current server port (GH-1257)</changelog>
  <changelog author="tchvatal@suse.com" date="1557489600">- Update to 1.38.0:
  * This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry.
  * It also fixes the bug that HTTP/1.1 chunked request stalls.
  * Now nghttpx does not log authorization request header field value with -LINFO.
  * This release fixes possible backend stall when header and request body are sent in their own packets.
  * The backend option gets weight parameter to influence backend selection.
  * This release fixes compile error with BoringSSL.
- Add patch from upstream to build with new boost bsc#1134616:
  * boost170.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1565697600">- Update to version 1.39.1:
  * This release fixes the bug that log-level is not set with
    cmd-line or configuration file. It also fixes FPE with default
    backend.
- Changes for version 1.39.0:
  * libnghttp2 now ignores content-length in 200 response to
    CONNECT request as per RFC 7230.
  * mruby has been upgraded to 2.0.1.
  * libnghttp2-asio now supports boost-1.70.
  * http-parser has been replaced with llhttp.
  * nghttpx now ignores Content-Length and Transfer-Encoding in 1xx
    or 200 to CONNECT.
- Drop no longer needed boost170.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1566216000">- Update to version 1.39.2 (bsc#1146184, bsc#1146182):
  * This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513
  “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2
  frames cause Denial of Service by consuming CPU time. Check out
  https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
  for details. For nghttpx, additionally limiting inbound traffic by
  - -read-rate and --read-burst options is quite effective against
  this kind of attack.
  * Add nghttp2_option_set_max_outbound_ack API function
  * nghttpx: Fix request stall</changelog>
  <changelog author="mpluskal@suse.com" date="1566216001">- Require correct library from devel package - boo#1125689</changelog>
  <changelog author="mpluskal@suse.com" date="1567166400">- Conditionally remove dependecy on jemalloc for SLE-12</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579003200">- Update to version 1.40.0 to fix CVE-2019-18802 in envoy-proxy and
  cilium-proxy (bsc#1166481)
  * lib: Add nghttp2_check_authority as public API
  * lib: Fix the bug that stream is closed with wrong error code
  * lib: Faster huffman encoding and decoding
  * build: Avoid filename collision of static and dynamic lib
  * build: Add new flag ENABLE_STATIC_CRT for Windows
  * build: cmake: Support building nghttpx with systemd
  * third-party: Update neverbleed to fix memory leak
  * nghttpx: Fix bug that mruby is incorrectly shared between
    backends
  * nghttpx: Reconnect h1 backend if it lost connection before
    sending headers
  * nghttpx: Returns 408 if backend timed out before sending
    headers
  * nghttpx: Fix request stal</changelog>
  <changelog author="pgajdos@suse.com" date="1615550400">- security update
- added patches
  fix CVE-2020-11080 [bsc#1181358], HTTP/2 Large Settings Frame DoS
  + nghttp2-CVE-2020-11080.patch</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1695729600">- Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be
  sent, and nghttp2_on_stream_close_callback fails with a fatal error.
  [CVE-2023-35945 bsc#1215713]
  + nghttp2-CVE-2023-35945.patch</changelog>
</package>
<package pkgid="f0cc94cda0cf8f7b3964eee020fd9e9afd5e9f8ee00f3e97a240c75b2bf8e572" name="libnghttp2-14" arch="x86_64">
  <version epoch="0" ver="1.40.0" rel="150200.9.1"/>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Export PYTHON=/usr/bin/python3 before running configure: allow to
  build without (comnplete) python2 in the buildroot. In any case
  we only ship python3-bindings already.</changelog>
  <changelog author="mpluskal@suse.com" date="1515153600">- Update to version 1.29.0:
  * lib: Use NGHTTP2_REFUSED_STREAM for streams which are closed by
    GOAWAY
  * build: Remove SPDY
  * build: Fix CMAKE_MODULE_PATH
  * nghttpx: Revert "nghttpx: Use an existing h2 backend connection
    as much as possible"
  * nghttpx: Write API request body in temporary file
  * nghttpx: Increase api-max-request-body
  * nghttpx: Faster configuration loading with lots of backends
  * nghttpx: Fix crash with --backend-http-proxy-uri option</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="tchvatal@suse.com" date="1523275200">- Drop spdylay dependency as it is deprecated since version 1.28.0
  and removed from cofnigure.ac since 1.29.0</changelog>
  <changelog author="tchvatal@suse.com" date="1523275201">- Version update to 1.31.0:
  * lib: Add nghttp2_session_set_user_data() public API function (GH-1137)
  * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128)
  * nghttpx: Close listening socket on graceful shutdown
  * nghttpx: Add an option to accept expired client certificate (GH-1126)
  * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123)
  * nghttpx: Fix potential memory leak
  * lib: Allow PING frame to be sent after GOAWAY (GH-1103)
  * nghttpx: Fix bug that h1 backend idle timeout expires sooner
  * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119)
  * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099)
  * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094)
  * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101)</changelog>
  <changelog author="tchvatal@suse.com" date="1523620800">- Version umpdate to 1.31.1:
  * Fix bsc#1088639 CVE-2018-1000168
  * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/</changelog>
  <changelog author="mpluskal@suse.com" date="1531137600">- Update to version 1.32.0:
  * lib: Ignore all input after calling session_terminate_session
  * lib: Fix treatment of padding
  * lib: Don't allow 101 HTTP status code because HTTP/2 removes
    HTTP Upgrade
  * build: add ENABLE_STATIC_LIB option to build static lib
  * third-party: Upgrade neverbleed to the latest master
  * asio: Support client side SNI
  * src: Compile with libressl 2.7.2
  * src: Allow building without NPN
  * h2load: -r and --duration are mutually exclusive</changelog>
  <changelog author="adam.majer@suse.de" date="1537963200">- Update to version 1.33.0:
  * lib: Tweak nghttp2_session_set_stream_user_data
  * lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS.
  * lib: Implement ORIGIN frame
  * asio: support definition of local endpoint for cleartext
    client session
  * integration: Remove remaining SPDY code from the integration tests
  * nghttpx: Fix worker process crash with neverbleed write error
  * nghttpx: Support per-backend mruby script
  * nghttpx: Fix stream reset if data from client is arrived before
    dconn is attached</changelog>
  <changelog author="adam.majer@suse.de" date="1539000000">- Update to version 1.34.0: (bsc#1112438, FATE#326776)
  * lib: Implement RFC 8441 :protocol support
  * nghttpx: Add read/write-timeout parameters to backend option
  * nghttpx: Fix mruby parameter validation in backend option
  * nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2
  * nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues
  * nghttpx: Update mruby 1.4.1
  * nghttpx: Add mruby env.tls_handshake_finished
  * nghttpx: Add --tls13-ciphers and --tls-client-ciphers options
  * nghttpx: Add RFC 8470 Early-Data header field support
  * nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support</changelog>
  <changelog author="mpluskal@suse.com" date="1547208000">- Update to version 1.35.1:
  * nghttpx: Fix broken trailing slash handling (GH-1276)
- Changes for version 1.35:
  * build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238)
  * lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222)
  * src: Require C++14 language feature
  * nghttpx: Write mruby send_info early
  * nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend
  * h2load: Handle HTTP/1 non-final response (GH-1259)
  * h2load: Clarify that time for connect includes TLS handshake</changelog>
  <changelog author="tchvatal@suse.com" date="1547812800">- Use multibuild to not pull in python3 in first build, nghttp2
  is low in the system</changelog>
  <changelog author="seanlew@opensuse.org" date="1547812801">- Update to 1.36.0
  * build: disable shared library if ENABLE_SHARED_LIB is off
  * third-party: use http-parser to v2.9.0 (GH-1294)
  * third-party: Update mruby to 2.0.0
  * nghttpx: Pool h1 backend connection per address (GH-1292)
  * nghttpx: Randomize backend address round robin order per thread
    (GH-1291)
  * nghttpx: Fix getting long SNs for openssl &lt; 1.1 (GH-1287)
  * h2load: add an option to write per-request logs (GH-1256)
  * asio: added access to # of the current server port (GH-1257)</changelog>
  <changelog author="tchvatal@suse.com" date="1557489600">- Update to 1.38.0:
  * This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry.
  * It also fixes the bug that HTTP/1.1 chunked request stalls.
  * Now nghttpx does not log authorization request header field value with -LINFO.
  * This release fixes possible backend stall when header and request body are sent in their own packets.
  * The backend option gets weight parameter to influence backend selection.
  * This release fixes compile error with BoringSSL.
- Add patch from upstream to build with new boost bsc#1134616:
  * boost170.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1565697600">- Update to version 1.39.1:
  * This release fixes the bug that log-level is not set with
    cmd-line or configuration file. It also fixes FPE with default
    backend.
- Changes for version 1.39.0:
  * libnghttp2 now ignores content-length in 200 response to
    CONNECT request as per RFC 7230.
  * mruby has been upgraded to 2.0.1.
  * libnghttp2-asio now supports boost-1.70.
  * http-parser has been replaced with llhttp.
  * nghttpx now ignores Content-Length and Transfer-Encoding in 1xx
    or 200 to CONNECT.
- Drop no longer needed boost170.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1566216000">- Update to version 1.39.2 (bsc#1146184, bsc#1146182):
  * This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513
  “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2
  frames cause Denial of Service by consuming CPU time. Check out
  https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
  for details. For nghttpx, additionally limiting inbound traffic by
  - -read-rate and --read-burst options is quite effective against
  this kind of attack.
  * Add nghttp2_option_set_max_outbound_ack API function
  * nghttpx: Fix request stall</changelog>
  <changelog author="mpluskal@suse.com" date="1566216001">- Require correct library from devel package - boo#1125689</changelog>
  <changelog author="mpluskal@suse.com" date="1567166400">- Conditionally remove dependecy on jemalloc for SLE-12</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579003200">- Update to version 1.40.0 to fix CVE-2019-18802 in envoy-proxy and
  cilium-proxy (bsc#1166481)
  * lib: Add nghttp2_check_authority as public API
  * lib: Fix the bug that stream is closed with wrong error code
  * lib: Faster huffman encoding and decoding
  * build: Avoid filename collision of static and dynamic lib
  * build: Add new flag ENABLE_STATIC_CRT for Windows
  * build: cmake: Support building nghttpx with systemd
  * third-party: Update neverbleed to fix memory leak
  * nghttpx: Fix bug that mruby is incorrectly shared between
    backends
  * nghttpx: Reconnect h1 backend if it lost connection before
    sending headers
  * nghttpx: Returns 408 if backend timed out before sending
    headers
  * nghttpx: Fix request stal</changelog>
  <changelog author="pgajdos@suse.com" date="1615550400">- security update
- added patches
  fix CVE-2020-11080 [bsc#1181358], HTTP/2 Large Settings Frame DoS
  + nghttp2-CVE-2020-11080.patch</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1695729600">- Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be
  sent, and nghttp2_on_stream_close_callback fails with a fatal error.
  [CVE-2023-35945 bsc#1215713]
  + nghttp2-CVE-2023-35945.patch</changelog>
</package>
<package pkgid="2b47a16f8dd5ae1a5c5519b34f54fc172a7fc56d4a03f92612d59d697393b7cf" name="libnvme" arch="src">
  <version epoch="0" ver="1.4+29.ga3cf0a" rel="150500.4.9.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
  <changelog author="dwagner@suse.de" date="1690459200">- Update to version 1.4+27.g5ae1c3:
  * tree: Add getter for subsystem iopolicy (bsc#1124564)
  * nvme-tree: avoid warning in 'list-subsys' (bsc#bsc#1212598)
  * tree: Scan all subsystems (bsc#bsc#1212598)
  * tree: Don't open nvme devices until it's absolutely required
    (bsc#1213527 bsc#1213686)
  * tree: Use nvme_ipaddrs_eq() to compare IP addresses
  * util: rename ipaddrs_eq() to nvme_ipaddrs_eq() and make public.
  * util: Add ipaddrs_eq() to check whether two IP addresses are equal
  * fabrics: check genctr after getting discovery entries (bsc#1213618)
  * ioctl: fix RAE bit on last Get Log Page command (bsc#1213618)</changelog>
  <changelog author="dwagner@suse.de" date="1693915200">- Update to version 1.4+29.ga3cf0a:
  * tree: fix segfault in nvme_scan_subsystem() (bsc#1213993)
  * src/nvme/tree.c: make __nvme_scan_subsystem() returning bool (bsc#1213993)</changelog>
</package>
<package pkgid="7389efae7ae241e8456bd58b68b9e7539ff4e58747dc507a95ad9cc63e54aead" name="libnvme-mi1" arch="aarch64">
  <version epoch="0" ver="1.4+29.ga3cf0a" rel="150500.4.9.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
  <changelog author="dwagner@suse.de" date="1690459200">- Update to version 1.4+27.g5ae1c3:
  * tree: Add getter for subsystem iopolicy (bsc#1124564)
  * nvme-tree: avoid warning in 'list-subsys' (bsc#bsc#1212598)
  * tree: Scan all subsystems (bsc#bsc#1212598)
  * tree: Don't open nvme devices until it's absolutely required
    (bsc#1213527 bsc#1213686)
  * tree: Use nvme_ipaddrs_eq() to compare IP addresses
  * util: rename ipaddrs_eq() to nvme_ipaddrs_eq() and make public.
  * util: Add ipaddrs_eq() to check whether two IP addresses are equal
  * fabrics: check genctr after getting discovery entries (bsc#1213618)
  * ioctl: fix RAE bit on last Get Log Page command (bsc#1213618)</changelog>
  <changelog author="dwagner@suse.de" date="1693915200">- Update to version 1.4+29.ga3cf0a:
  * tree: fix segfault in nvme_scan_subsystem() (bsc#1213993)
  * src/nvme/tree.c: make __nvme_scan_subsystem() returning bool (bsc#1213993)</changelog>
</package>
<package pkgid="f55ea955a7c5d7bf882cde45251884b7cb8c592aa4c85399c13eb554e6fdc98b" name="libnvme-mi1" arch="s390x">
  <version epoch="0" ver="1.4+29.ga3cf0a" rel="150500.4.9.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
  <changelog author="dwagner@suse.de" date="1690459200">- Update to version 1.4+27.g5ae1c3:
  * tree: Add getter for subsystem iopolicy (bsc#1124564)
  * nvme-tree: avoid warning in 'list-subsys' (bsc#bsc#1212598)
  * tree: Scan all subsystems (bsc#bsc#1212598)
  * tree: Don't open nvme devices until it's absolutely required
    (bsc#1213527 bsc#1213686)
  * tree: Use nvme_ipaddrs_eq() to compare IP addresses
  * util: rename ipaddrs_eq() to nvme_ipaddrs_eq() and make public.
  * util: Add ipaddrs_eq() to check whether two IP addresses are equal
  * fabrics: check genctr after getting discovery entries (bsc#1213618)
  * ioctl: fix RAE bit on last Get Log Page command (bsc#1213618)</changelog>
  <changelog author="dwagner@suse.de" date="1693915200">- Update to version 1.4+29.ga3cf0a:
  * tree: fix segfault in nvme_scan_subsystem() (bsc#1213993)
  * src/nvme/tree.c: make __nvme_scan_subsystem() returning bool (bsc#1213993)</changelog>
</package>
<package pkgid="b47ad515fd050126c06f86f304dc0b22a98fbcc2ccaf15422629af110811d7e6" name="libnvme-mi1" arch="x86_64">
  <version epoch="0" ver="1.4+29.ga3cf0a" rel="150500.4.9.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
  <changelog author="dwagner@suse.de" date="1690459200">- Update to version 1.4+27.g5ae1c3:
  * tree: Add getter for subsystem iopolicy (bsc#1124564)
  * nvme-tree: avoid warning in 'list-subsys' (bsc#bsc#1212598)
  * tree: Scan all subsystems (bsc#bsc#1212598)
  * tree: Don't open nvme devices until it's absolutely required
    (bsc#1213527 bsc#1213686)
  * tree: Use nvme_ipaddrs_eq() to compare IP addresses
  * util: rename ipaddrs_eq() to nvme_ipaddrs_eq() and make public.
  * util: Add ipaddrs_eq() to check whether two IP addresses are equal
  * fabrics: check genctr after getting discovery entries (bsc#1213618)
  * ioctl: fix RAE bit on last Get Log Page command (bsc#1213618)</changelog>
  <changelog author="dwagner@suse.de" date="1693915200">- Update to version 1.4+29.ga3cf0a:
  * tree: fix segfault in nvme_scan_subsystem() (bsc#1213993)
  * src/nvme/tree.c: make __nvme_scan_subsystem() returning bool (bsc#1213993)</changelog>
</package>
<package pkgid="7284663085c488a8b5986a6c10dd8c14b41712efdec0d2296257d5efc1a91876" name="libnvme1" arch="aarch64">
  <version epoch="0" ver="1.4+29.ga3cf0a" rel="150500.4.9.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
  <changelog author="dwagner@suse.de" date="1690459200">- Update to version 1.4+27.g5ae1c3:
  * tree: Add getter for subsystem iopolicy (bsc#1124564)
  * nvme-tree: avoid warning in 'list-subsys' (bsc#bsc#1212598)
  * tree: Scan all subsystems (bsc#bsc#1212598)
  * tree: Don't open nvme devices until it's absolutely required
    (bsc#1213527 bsc#1213686)
  * tree: Use nvme_ipaddrs_eq() to compare IP addresses
  * util: rename ipaddrs_eq() to nvme_ipaddrs_eq() and make public.
  * util: Add ipaddrs_eq() to check whether two IP addresses are equal
  * fabrics: check genctr after getting discovery entries (bsc#1213618)
  * ioctl: fix RAE bit on last Get Log Page command (bsc#1213618)</changelog>
  <changelog author="dwagner@suse.de" date="1693915200">- Update to version 1.4+29.ga3cf0a:
  * tree: fix segfault in nvme_scan_subsystem() (bsc#1213993)
  * src/nvme/tree.c: make __nvme_scan_subsystem() returning bool (bsc#1213993)</changelog>
</package>
<package pkgid="ff6a4bd0aa557fd4e04fe049a7f91784cb7bfba28e829cae0a3dbcd956e569fd" name="libnvme1" arch="s390x">
  <version epoch="0" ver="1.4+29.ga3cf0a" rel="150500.4.9.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
  <changelog author="dwagner@suse.de" date="1690459200">- Update to version 1.4+27.g5ae1c3:
  * tree: Add getter for subsystem iopolicy (bsc#1124564)
  * nvme-tree: avoid warning in 'list-subsys' (bsc#bsc#1212598)
  * tree: Scan all subsystems (bsc#bsc#1212598)
  * tree: Don't open nvme devices until it's absolutely required
    (bsc#1213527 bsc#1213686)
  * tree: Use nvme_ipaddrs_eq() to compare IP addresses
  * util: rename ipaddrs_eq() to nvme_ipaddrs_eq() and make public.
  * util: Add ipaddrs_eq() to check whether two IP addresses are equal
  * fabrics: check genctr after getting discovery entries (bsc#1213618)
  * ioctl: fix RAE bit on last Get Log Page command (bsc#1213618)</changelog>
  <changelog author="dwagner@suse.de" date="1693915200">- Update to version 1.4+29.ga3cf0a:
  * tree: fix segfault in nvme_scan_subsystem() (bsc#1213993)
  * src/nvme/tree.c: make __nvme_scan_subsystem() returning bool (bsc#1213993)</changelog>
</package>
<package pkgid="426c27e24cb86ff6d94114219d9abeeddd4a679b43bda82c30cf8ef711a6fa3e" name="libnvme1" arch="x86_64">
  <version epoch="0" ver="1.4+29.ga3cf0a" rel="150500.4.9.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Remove Provide for python package.
- Remove explicit tar file name for setup step.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 1.0~2:
  * Add fabrics config option 'tls'
  * Logging infrastructure reworked (API break)
  * Changed argument structs layout (API break)
  * Changed scan API (API break)
  * Fixed ctrl_loss_tmo handling concerning values of '-1'
  * Various build fixes</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v1.0-rc3:
  * Properly create manuals/documentation
  * Fix memleaks in __nvme_free_ns() and nvme_scan_subsystem()
  * nvme: get log domain id included in Log Specific Identifier
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
  * ioctl: Add identify ioctl for CNS 09h, 0Ah
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * tree: do not set dhchap_key to 'none'
  * tree: restart controller lookup
  * tree: fixup memory leak in nvme_scan_ctrl()
  * Rename nvme_path_get_subsystem()
  * Remove nvme_reset_topology()
- Use precompiled documentation instead regenerating it</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 1.0-rc4:
  * fabrics: add default port number for NVMe/TCP I/O controllers
  * linux: Update size when telemetry controller initiated data is unavailable
  * add cdw13 for set_feature_args structure
  * Add support for TP8010
  * Documentation cleanups</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 1.0-rc5:
  * ioctl: Set lsp to action in nvme_get_log_persistent_event (bsc#1196121)
  * tree: Ignore traddr case in nvme_lookup_ctrl() (bsc#1194025)
  * fabrics: Do not swap bytes for system uuid (bsc#1196565)
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646740800">- Update License information. The library is released under
  LGPL-2.1-or-later and not LGPL-2.1-only.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 1.0-rc6:
  * tree: add nvme_ctrl_get_ana_state() (bsc#1195938)
  * tree: link paths to namespaces in nvme_subsystem_scan_namespace() (bsc#1195938)
  * ioctl.h: ns list bug fix (wrong cns value)
  * types.h: Key Value Command Set Identifier added (NVME_CSI_KV)
  * types: fix status code type bug (wrong masking)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 1.0-rc7:
  * linux: fixup log page offset in nvme_get_log_page()
  * tree: Add support for default trsvcid for all controllers (bsc#1195858)
  * tree: fixup coredump during nvme discover</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 1.0-rc8:
  * types: Add support for get log - MI Command Supported
  * types: Add new Identify constant
  * types: Update persistent event entry struct added new fields
  * types: Add Host Initiated Data Gen Number to telemetry log struct
  * tree: always allocate config file in nvme_read_config()
  * tree: rework nvme_scan_subsystem()
  * tree: make subsystem name mandatory in nvme_scan_ctrl()
  * tree: move nvme_init_subsystem() into nvme_lookup_subsystem()
  * tree: do not return error when filtering out subsystems
  * tree: add debugging messages during scanning
  * tree: Handle NULL subsysname in nvme_scan_ctrl()
  * tree: Fix subsystem initialization in nvme_scan_ctrl()
  * tree: Fix leaking 'name' in nvme_subsystem_lookup_namespace()
  * tree: Avoid dereferencing nvme_subsystem_t before its check for NULL
  * tree: Clarify NULL return values from nvme_get_attr()
  * fabrics: Invoke nvmf_dim() with provided tas argument
  * fabrics: add 'nvmf_update_config()'
  * fabrics: Avoid out of bounds string chomping
  * fabrics: Free old traddr in nvmf_add_ctrl
  * fabrics: update log level for write failures
  * fabrics: Streamlining documentation
  * fabrics: Fix leaking ctrl in nvmf_connect_disc_entry()
  * fabrics: Add missing break in a switch
  * ioctl: Remove attribute packed and alignedof for args structs
  * ioctl: Align arguments indentation with braces
  * json: fix endless loop scanning for controllers
  * Remove nvme_init_id_ns
  * Add lbstm support for create-ns
  * documentation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 1.0:
  * tree: Remove default port setting for TCP and RDMA ports
  * tree: add 'f_args' argument to pass user data to the filter function
  * tree: remove 'ctrl_get_ana_state()'
  * tree: add namespace path iterators
  * tree: filter out namespaces
  * tree: update nvme_scan_filter_t usage</changelog>
  <changelog author="dwagner@suse.de" date="1654257600">- Reduce log noise and export error codes (bsc#1199994 bsc#1199503)
  * add 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * add 0002-fabrics-Remove-double-connection-error-logging.patch
  * add 0003-fabrics-Introduce-connection-connect-error-mapping.patch
- Apply configuration from JSON file (bsc#1199503)
  * add 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * add 0005-tree-Factor-lookup-code-for-controller.patch
  * add 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Fixes for controller authentication (bsc#1201501 bsc#1201700 bsc#1201701 bsc#1201717)
  * add 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * add 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * add 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * add 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * add 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * add 0012-Parse-dhchap_host_key-on-controller-level.patch
  * add 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * add 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * add 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
- Subsystem scanning logic fixes
  * add 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * add 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * add 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
- Fix PowerPC build warnings
  * add 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
- Fabrics fixes
  * add 0020-fabrics-sanitize-dump-config-output.patch
  * add 0021-fabrics-Fix-build_options-return-values.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 1.2 (jsc#PED-553):
  * 64-bit Reference Tags and TP-4068 changes
  * Add more details for return code of MI admin cmds
  * Fix poll.h includes
  * Parse dhchap_host_key on controller level
  * Regenerate all documentation
  * Update json config schema for missing dhchap host key
  * build: Add support to build against LibreSSL
  * build: Drop -nostdinc for LibreSSL header checks
  * fabrics: Add new TP8010 definitions
  * fabrics: Add nvmf_get_discovery_wargs()
  * fabrics: Duplicate strings when merging configs
  * fabrics: Filter out empty strings in add_argument()
  * fabrics: Fix build_options() return values
  * fabrics: Use fallthrough statement
  * fabrics: sanitize dump-config output
  * ioctl: Honor rae in nvme_get_nsid_log
  * ioctl: Set log page offset for nvme_get_log_telemetry_host
  * json-schema: add dhchap_key details to host section
  * json: Enforce correctly formatted JSON config files
  * json: Verify JSON config file starts with an array
  * json: fixup dhchap_ctrl_key definitions
  * libnvme-mi: Introduce NVMe Managament Interface library
  * mi-mctp: Add timeout support to MCTP transport
  * mi: Add Get Log Page helpers
  * mi: Add Identify function for secondary controller list
  * mi: Add Identify helper for ns-descs and primary-ctrl-caps
  * mi: Add endpoint get/set timeout API
  * mi: Add firmware download and commit commands
  * mi: Add identify helper for nsid-capable Controller List
  * mi: Add identify helpers for namespace lists
  * mi: Add identify helpers for namespaces
  * mi: Add maximum More Processing Required limit API
  * mi: Allow Admin-message sized More Processing Required responses
  * mi: Distinguish MI status from NVMe (CDW3) status
  * mi: Fix C++ compiler errors
  * mi: Implement Format NVM command
  * mi: Implement Get &amp; Set Features Admin commands
  * mi: Implement NS attach command and helpers
  * mi: Implement Namespace Management command and create/delete helpers
  * mi: Implement Sanitize command
  * mi: Init ctrl_id within xfer
  * mi: Introduce a helper for response status, unify values with ioctls
  * mi: Set log page offset for nvme_get_log_telemetry_host
  * mi: add nvme_mi_status_to_string()
  * mi: fix a memory leak in nvme_mi_open_mctp()
  * mi: fix get_log_page chunked offset check
  * mi: unify MI Get Log Page function with ioctl API
  * nvme-tree: avoid segfault if auth keys are unavailable
  * python: Use nvmf_get_discovery_wargs()
  * python: add missing ctrl attrs to Python bindings
  * rpmbuild: Enable 'make rpm' to build rpm pkgs #408
  * tree: rename controller 'dhchap_key' to 'dhchap_ctrl_key'
  * types: Move enum nvme_data_tfr to types
  * update/cleanup of documentation
  * util: Add LINE_MAX define
  * util: Add get feature length 2 API to support direction parameter
  * util: Add simple UUID type
  * util: Do not expose fallthrough defines
  * various build fixes
  * various fixes reported by coverity
- Drop upstream patches
  * remove 0001-fabrics-Lower-log-level-in-__nvmf_add_ctrl.patch
  * remove 0002-fabrics-Remove-double-connection-error-logging.patch
  * remove 0003-fabrics-Introduce-connection-connect-error-mapping.patch
  * remove 0004-libnvme-Export-nvme_ctrl_get_config.patch
  * remove 0005-tree-Factor-lookup-code-for-controller.patch
  * remove 0006-fabrics-Consider-config-from-file-when-adding-new-co.patch
  * remove 0007-python-add-missing-ctrl-attrs-to-Python-bindings.patch
  * remove 0008-libnvme-accessors-for-dhchap_key-variables.patch
  * remove 0009-fabrics-Update-controller-authentication-in-nvmf_add.patch
  * remove 0010-json-fixup-dhchap_ctrl_key-definitions.patch
  * remove 0011-tree-rename-controller-dhchap_key-to-dhchap_ctrl_key.patch
  * remove 0012-Parse-dhchap_host_key-on-controller-level.patch
  * remove 0013-json-schema-add-dhchap_key-details-to-host-section.patch
  * remove 0014-nvme-tree-avoid-segfault-if-auth-keys-are-unavailabl.patch
  * remove 0015-fabrics-restructrure-nvmf_get_discovery_log.patch
  * remove 0016-tree-simplifiy-nvme_subsystem_lookup_namespace.patch
  * remove 0017-tree-make-nvme_subsystem_scan_namespace-idempotent.patch
  * remove 0018-tree-make-nvme_ctrl_scan_namespace-idempotent.patch
  * remove 0019-Fix-llx-lx-build-warnings-on-powerpc.patch
  * remove 0020-fabrics-sanitize-dump-config-output.patch
  * remove 0021-fabrics-Fix-build_options-return-values.patch
- Make man page build conditiional. Install man page location has been
  fixed upstream.
- Mark the Python directory own by the libnvme3-python package
- Use fixed manpage build date (boo#1047218)
- Fix installation of manual pages to make them accessible</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 1.2+1.g41e1016:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Use symbol version LIBNVME_1_2_1 for nbft support options
  * 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
  * added %test section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- temporarily disable unit tests on s390x (bsc#1207687, bsc#1207686)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1685016000">- Update to version v1.4 (jsc#PED-553 jsc#PED-3884)
  - Fix invalid string lenght calculcation for UUID (bsc#1209906)
  * fabrics: Fix bad UUID size introduced in recent UUID changes
  - Fix segmentation fault during garbage collection (bsc#1209905)
  * python: Fix segmentation fault during garbage collection
  * Python: Fix crash during garbage collection
  - Always sanitize traddr and trsvcid entries (bsc#1207435)
  * fabrics: Always sanitize discovery log entries
  * util: Add ECONNECTREFUSED to enum nvme_connect_err
  - Allow tracking unique discover controllers (bsc#1186689)
  * tree: Add unique discovery controller flag
  - Enabled unit test on s390x again (bsc#1207687, bsc#1207686)
  * test: mi: Explicitly zero args for test API invocations
- Replaced old nbft implementation with the upstream one
- Applied nbft symbol patch directly
  * remove 0001-libnvme-use-LIBNVME_1_2_1-version-for-nbft-commands.patch
- Don't enable TLS if kernel does not support it (git-fixes)
  * fabrics: Do not pass unsupported options to kernel
- Set version-tag so that version are correctly reported</changelog>
  <changelog author="dwagner@suse.de" date="1690459200">- Update to version 1.4+27.g5ae1c3:
  * tree: Add getter for subsystem iopolicy (bsc#1124564)
  * nvme-tree: avoid warning in 'list-subsys' (bsc#bsc#1212598)
  * tree: Scan all subsystems (bsc#bsc#1212598)
  * tree: Don't open nvme devices until it's absolutely required
    (bsc#1213527 bsc#1213686)
  * tree: Use nvme_ipaddrs_eq() to compare IP addresses
  * util: rename ipaddrs_eq() to nvme_ipaddrs_eq() and make public.
  * util: Add ipaddrs_eq() to check whether two IP addresses are equal
  * fabrics: check genctr after getting discovery entries (bsc#1213618)
  * ioctl: fix RAE bit on last Get Log Page command (bsc#1213618)</changelog>
  <changelog author="dwagner@suse.de" date="1693915200">- Update to version 1.4+29.ga3cf0a:
  * tree: fix segfault in nvme_scan_subsystem() (bsc#1213993)
  * src/nvme/tree.c: make __nvme_scan_subsystem() returning bool (bsc#1213993)</changelog>
</package>
<package pkgid="9baa07daa9aeaf8ce3d5756c450aa6a8b745e94f6601e33e20c71739f0c236f5" name="libopenssl-1_1-devel" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150500.17.19.1"/>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1669982400">- POWER10 performance enhancements for cryptography [jsc#PED-512]
  * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch
  * openssl-1_1-Fixed-counter-overflow.patch
  * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch
  * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch
  * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">- FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685534400">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1686744000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Reworked the Fix for the Timing Oracle in RSA Decryption
    The previous fix for this timing side channel turned out to cause
    a severe 2-3x performance regression in the typical use case
    compared to 1.1.1s.
  * Add openssl-CVE-2022-4304.patch
  * Removed patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch
  * Refreshed patches:
  - openssl-CVE-2023-0464.patch
  - openssl-CVE-2023-0465.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1689854400">- Security fix: [bsc#1213487, CVE-2023-3446]
  * Fix DH_check() excessive time with over sized modulus.
  * The function DH_check() performs various checks on DH parameters.
    One of those checks confirms that the modulus ("p" parameter) is
    not too large. Trying to use a very large modulus is slow and
    OpenSSL will not normally use a modulus which is over 10,000 bits
    in length.
    However the DH_check() function checks numerous aspects of the
    key or parameters that have been supplied. Some of those checks
    use the supplied modulus value even if it has already been found
    to be too large.
    A new limit has been added to DH_check of 32,768 bits. Supplying
    a key/parameters with a modulus over this size will simply cause
    DH_check() to fail.
  * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1690200000">- Dont pass zero length input to EVP_Cipher because assembler
  optimized AES cannot handle zero size. [bsc#1213517]
  * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1690891200">- Security fix: (bsc#1213853, CVE-2023-3817)
  * Fix excessive time spent checking DH q parameter value
    (bsc#1213853, CVE-2023-3817). The function DH_check() performs
    various checks on DH parameters. After fixing CVE-2023-3446 it
    was discovered that a large q parameter value can also trigger
    an overly long computation during some of these checks. A
    correct q value, if present, cannot be larger than the modulus
    p parameter, thus it is unnecessary to perform these checks if
    q is larger than p. If DH_check() is called with such q parameter
    value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
    computationally intensive checks are skipped.
  * Add openssl-1_1-CVE-2023-3817.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696420800">- Displays "fips" in the version string (bsc#1215215)
  * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch</changelog>
</package>
<package pkgid="d30b9b49185cc3a345e2fe79df465d94eac044df480c9793cf09f8665598aac1" name="libopenssl-1_1-devel" arch="s390x">
  <version epoch="0" ver="1.1.1l" rel="150500.17.19.1"/>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1669982400">- POWER10 performance enhancements for cryptography [jsc#PED-512]
  * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch
  * openssl-1_1-Fixed-counter-overflow.patch
  * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch
  * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch
  * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">- FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685534400">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1686744000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Reworked the Fix for the Timing Oracle in RSA Decryption
    The previous fix for this timing side channel turned out to cause
    a severe 2-3x performance regression in the typical use case
    compared to 1.1.1s.
  * Add openssl-CVE-2022-4304.patch
  * Removed patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch
  * Refreshed patches:
  - openssl-CVE-2023-0464.patch
  - openssl-CVE-2023-0465.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1689854400">- Security fix: [bsc#1213487, CVE-2023-3446]
  * Fix DH_check() excessive time with over sized modulus.
  * The function DH_check() performs various checks on DH parameters.
    One of those checks confirms that the modulus ("p" parameter) is
    not too large. Trying to use a very large modulus is slow and
    OpenSSL will not normally use a modulus which is over 10,000 bits
    in length.
    However the DH_check() function checks numerous aspects of the
    key or parameters that have been supplied. Some of those checks
    use the supplied modulus value even if it has already been found
    to be too large.
    A new limit has been added to DH_check of 32,768 bits. Supplying
    a key/parameters with a modulus over this size will simply cause
    DH_check() to fail.
  * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1690200000">- Dont pass zero length input to EVP_Cipher because assembler
  optimized AES cannot handle zero size. [bsc#1213517]
  * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1690891200">- Security fix: (bsc#1213853, CVE-2023-3817)
  * Fix excessive time spent checking DH q parameter value
    (bsc#1213853, CVE-2023-3817). The function DH_check() performs
    various checks on DH parameters. After fixing CVE-2023-3446 it
    was discovered that a large q parameter value can also trigger
    an overly long computation during some of these checks. A
    correct q value, if present, cannot be larger than the modulus
    p parameter, thus it is unnecessary to perform these checks if
    q is larger than p. If DH_check() is called with such q parameter
    value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
    computationally intensive checks are skipped.
  * Add openssl-1_1-CVE-2023-3817.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696420800">- Displays "fips" in the version string (bsc#1215215)
  * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch</changelog>
</package>
<package pkgid="0e4f535af47d0bb96b37002f7c72d4ff85f194b28866a1a790b79b0f8281484d" name="libopenssl-1_1-devel" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150500.17.19.1"/>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1669982400">- POWER10 performance enhancements for cryptography [jsc#PED-512]
  * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch
  * openssl-1_1-Fixed-counter-overflow.patch
  * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch
  * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch
  * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">- FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685534400">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1686744000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Reworked the Fix for the Timing Oracle in RSA Decryption
    The previous fix for this timing side channel turned out to cause
    a severe 2-3x performance regression in the typical use case
    compared to 1.1.1s.
  * Add openssl-CVE-2022-4304.patch
  * Removed patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch
  * Refreshed patches:
  - openssl-CVE-2023-0464.patch
  - openssl-CVE-2023-0465.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1689854400">- Security fix: [bsc#1213487, CVE-2023-3446]
  * Fix DH_check() excessive time with over sized modulus.
  * The function DH_check() performs various checks on DH parameters.
    One of those checks confirms that the modulus ("p" parameter) is
    not too large. Trying to use a very large modulus is slow and
    OpenSSL will not normally use a modulus which is over 10,000 bits
    in length.
    However the DH_check() function checks numerous aspects of the
    key or parameters that have been supplied. Some of those checks
    use the supplied modulus value even if it has already been found
    to be too large.
    A new limit has been added to DH_check of 32,768 bits. Supplying
    a key/parameters with a modulus over this size will simply cause
    DH_check() to fail.
  * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1690200000">- Dont pass zero length input to EVP_Cipher because assembler
  optimized AES cannot handle zero size. [bsc#1213517]
  * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1690891200">- Security fix: (bsc#1213853, CVE-2023-3817)
  * Fix excessive time spent checking DH q parameter value
    (bsc#1213853, CVE-2023-3817). The function DH_check() performs
    various checks on DH parameters. After fixing CVE-2023-3446 it
    was discovered that a large q parameter value can also trigger
    an overly long computation during some of these checks. A
    correct q value, if present, cannot be larger than the modulus
    p parameter, thus it is unnecessary to perform these checks if
    q is larger than p. If DH_check() is called with such q parameter
    value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
    computationally intensive checks are skipped.
  * Add openssl-1_1-CVE-2023-3817.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696420800">- Displays "fips" in the version string (bsc#1215215)
  * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch</changelog>
</package>
<package pkgid="18da95ac39899dc7b6e7f6ab0f3b7ccde3a7cfb8d4b4570c29ad79e4dd52d443" name="libopenssl1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150500.17.19.1"/>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1669982400">- POWER10 performance enhancements for cryptography [jsc#PED-512]
  * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch
  * openssl-1_1-Fixed-counter-overflow.patch
  * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch
  * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch
  * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">- FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685534400">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1686744000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Reworked the Fix for the Timing Oracle in RSA Decryption
    The previous fix for this timing side channel turned out to cause
    a severe 2-3x performance regression in the typical use case
    compared to 1.1.1s.
  * Add openssl-CVE-2022-4304.patch
  * Removed patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch
  * Refreshed patches:
  - openssl-CVE-2023-0464.patch
  - openssl-CVE-2023-0465.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1689854400">- Security fix: [bsc#1213487, CVE-2023-3446]
  * Fix DH_check() excessive time with over sized modulus.
  * The function DH_check() performs various checks on DH parameters.
    One of those checks confirms that the modulus ("p" parameter) is
    not too large. Trying to use a very large modulus is slow and
    OpenSSL will not normally use a modulus which is over 10,000 bits
    in length.
    However the DH_check() function checks numerous aspects of the
    key or parameters that have been supplied. Some of those checks
    use the supplied modulus value even if it has already been found
    to be too large.
    A new limit has been added to DH_check of 32,768 bits. Supplying
    a key/parameters with a modulus over this size will simply cause
    DH_check() to fail.
  * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1690200000">- Dont pass zero length input to EVP_Cipher because assembler
  optimized AES cannot handle zero size. [bsc#1213517]
  * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1690891200">- Security fix: (bsc#1213853, CVE-2023-3817)
  * Fix excessive time spent checking DH q parameter value
    (bsc#1213853, CVE-2023-3817). The function DH_check() performs
    various checks on DH parameters. After fixing CVE-2023-3446 it
    was discovered that a large q parameter value can also trigger
    an overly long computation during some of these checks. A
    correct q value, if present, cannot be larger than the modulus
    p parameter, thus it is unnecessary to perform these checks if
    q is larger than p. If DH_check() is called with such q parameter
    value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
    computationally intensive checks are skipped.
  * Add openssl-1_1-CVE-2023-3817.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696420800">- Displays "fips" in the version string (bsc#1215215)
  * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch</changelog>
</package>
<package pkgid="b61b6361df1fccf626007dbc04173b32ee7c0ec4dd7f23d9512e6aa5ddc4c7be" name="libopenssl1_1" arch="s390x">
  <version epoch="0" ver="1.1.1l" rel="150500.17.19.1"/>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1669982400">- POWER10 performance enhancements for cryptography [jsc#PED-512]
  * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch
  * openssl-1_1-Fixed-counter-overflow.patch
  * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch
  * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch
  * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">- FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685534400">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1686744000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Reworked the Fix for the Timing Oracle in RSA Decryption
    The previous fix for this timing side channel turned out to cause
    a severe 2-3x performance regression in the typical use case
    compared to 1.1.1s.
  * Add openssl-CVE-2022-4304.patch
  * Removed patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch
  * Refreshed patches:
  - openssl-CVE-2023-0464.patch
  - openssl-CVE-2023-0465.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1689854400">- Security fix: [bsc#1213487, CVE-2023-3446]
  * Fix DH_check() excessive time with over sized modulus.
  * The function DH_check() performs various checks on DH parameters.
    One of those checks confirms that the modulus ("p" parameter) is
    not too large. Trying to use a very large modulus is slow and
    OpenSSL will not normally use a modulus which is over 10,000 bits
    in length.
    However the DH_check() function checks numerous aspects of the
    key or parameters that have been supplied. Some of those checks
    use the supplied modulus value even if it has already been found
    to be too large.
    A new limit has been added to DH_check of 32,768 bits. Supplying
    a key/parameters with a modulus over this size will simply cause
    DH_check() to fail.
  * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1690200000">- Dont pass zero length input to EVP_Cipher because assembler
  optimized AES cannot handle zero size. [bsc#1213517]
  * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1690891200">- Security fix: (bsc#1213853, CVE-2023-3817)
  * Fix excessive time spent checking DH q parameter value
    (bsc#1213853, CVE-2023-3817). The function DH_check() performs
    various checks on DH parameters. After fixing CVE-2023-3446 it
    was discovered that a large q parameter value can also trigger
    an overly long computation during some of these checks. A
    correct q value, if present, cannot be larger than the modulus
    p parameter, thus it is unnecessary to perform these checks if
    q is larger than p. If DH_check() is called with such q parameter
    value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
    computationally intensive checks are skipped.
  * Add openssl-1_1-CVE-2023-3817.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696420800">- Displays "fips" in the version string (bsc#1215215)
  * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch</changelog>
</package>
<package pkgid="b81fa14d871c6ef141d0ee0641c4a273c8d8e3cefee61a69cc905df9592c598f" name="libopenssl1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150500.17.19.1"/>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1669982400">- POWER10 performance enhancements for cryptography [jsc#PED-512]
  * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch
  * openssl-1_1-Fixed-counter-overflow.patch
  * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch
  * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch
  * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">- FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685534400">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1686744000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Reworked the Fix for the Timing Oracle in RSA Decryption
    The previous fix for this timing side channel turned out to cause
    a severe 2-3x performance regression in the typical use case
    compared to 1.1.1s.
  * Add openssl-CVE-2022-4304.patch
  * Removed patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch
  * Refreshed patches:
  - openssl-CVE-2023-0464.patch
  - openssl-CVE-2023-0465.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1689854400">- Security fix: [bsc#1213487, CVE-2023-3446]
  * Fix DH_check() excessive time with over sized modulus.
  * The function DH_check() performs various checks on DH parameters.
    One of those checks confirms that the modulus ("p" parameter) is
    not too large. Trying to use a very large modulus is slow and
    OpenSSL will not normally use a modulus which is over 10,000 bits
    in length.
    However the DH_check() function checks numerous aspects of the
    key or parameters that have been supplied. Some of those checks
    use the supplied modulus value even if it has already been found
    to be too large.
    A new limit has been added to DH_check of 32,768 bits. Supplying
    a key/parameters with a modulus over this size will simply cause
    DH_check() to fail.
  * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1690200000">- Dont pass zero length input to EVP_Cipher because assembler
  optimized AES cannot handle zero size. [bsc#1213517]
  * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1690891200">- Security fix: (bsc#1213853, CVE-2023-3817)
  * Fix excessive time spent checking DH q parameter value
    (bsc#1213853, CVE-2023-3817). The function DH_check() performs
    various checks on DH parameters. After fixing CVE-2023-3446 it
    was discovered that a large q parameter value can also trigger
    an overly long computation during some of these checks. A
    correct q value, if present, cannot be larger than the modulus
    p parameter, thus it is unnecessary to perform these checks if
    q is larger than p. If DH_check() is called with such q parameter
    value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
    computationally intensive checks are skipped.
  * Add openssl-1_1-CVE-2023-3817.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696420800">- Displays "fips" in the version string (bsc#1215215)
  * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch</changelog>
</package>
<package pkgid="fc4285fa6c0d66eb9990dc3ff47aa14ee9c44d7f2cb10d7cab729671ef13c772" name="libopenssl1_1-hmac" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150500.17.19.1"/>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1669982400">- POWER10 performance enhancements for cryptography [jsc#PED-512]
  * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch
  * openssl-1_1-Fixed-counter-overflow.patch
  * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch
  * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch
  * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">- FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685534400">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1686744000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Reworked the Fix for the Timing Oracle in RSA Decryption
    The previous fix for this timing side channel turned out to cause
    a severe 2-3x performance regression in the typical use case
    compared to 1.1.1s.
  * Add openssl-CVE-2022-4304.patch
  * Removed patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch
  * Refreshed patches:
  - openssl-CVE-2023-0464.patch
  - openssl-CVE-2023-0465.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1689854400">- Security fix: [bsc#1213487, CVE-2023-3446]
  * Fix DH_check() excessive time with over sized modulus.
  * The function DH_check() performs various checks on DH parameters.
    One of those checks confirms that the modulus ("p" parameter) is
    not too large. Trying to use a very large modulus is slow and
    OpenSSL will not normally use a modulus which is over 10,000 bits
    in length.
    However the DH_check() function checks numerous aspects of the
    key or parameters that have been supplied. Some of those checks
    use the supplied modulus value even if it has already been found
    to be too large.
    A new limit has been added to DH_check of 32,768 bits. Supplying
    a key/parameters with a modulus over this size will simply cause
    DH_check() to fail.
  * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1690200000">- Dont pass zero length input to EVP_Cipher because assembler
  optimized AES cannot handle zero size. [bsc#1213517]
  * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1690891200">- Security fix: (bsc#1213853, CVE-2023-3817)
  * Fix excessive time spent checking DH q parameter value
    (bsc#1213853, CVE-2023-3817). The function DH_check() performs
    various checks on DH parameters. After fixing CVE-2023-3446 it
    was discovered that a large q parameter value can also trigger
    an overly long computation during some of these checks. A
    correct q value, if present, cannot be larger than the modulus
    p parameter, thus it is unnecessary to perform these checks if
    q is larger than p. If DH_check() is called with such q parameter
    value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
    computationally intensive checks are skipped.
  * Add openssl-1_1-CVE-2023-3817.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696420800">- Displays "fips" in the version string (bsc#1215215)
  * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch</changelog>
</package>
<package pkgid="1448e691aea58350d356489c54421036785a8bae3787ed230ea8dbeaa950a119" name="libopenssl1_1-hmac" arch="s390x">
  <version epoch="0" ver="1.1.1l" rel="150500.17.19.1"/>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1669982400">- POWER10 performance enhancements for cryptography [jsc#PED-512]
  * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch
  * openssl-1_1-Fixed-counter-overflow.patch
  * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch
  * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch
  * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">- FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685534400">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1686744000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Reworked the Fix for the Timing Oracle in RSA Decryption
    The previous fix for this timing side channel turned out to cause
    a severe 2-3x performance regression in the typical use case
    compared to 1.1.1s.
  * Add openssl-CVE-2022-4304.patch
  * Removed patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch
  * Refreshed patches:
  - openssl-CVE-2023-0464.patch
  - openssl-CVE-2023-0465.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1689854400">- Security fix: [bsc#1213487, CVE-2023-3446]
  * Fix DH_check() excessive time with over sized modulus.
  * The function DH_check() performs various checks on DH parameters.
    One of those checks confirms that the modulus ("p" parameter) is
    not too large. Trying to use a very large modulus is slow and
    OpenSSL will not normally use a modulus which is over 10,000 bits
    in length.
    However the DH_check() function checks numerous aspects of the
    key or parameters that have been supplied. Some of those checks
    use the supplied modulus value even if it has already been found
    to be too large.
    A new limit has been added to DH_check of 32,768 bits. Supplying
    a key/parameters with a modulus over this size will simply cause
    DH_check() to fail.
  * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1690200000">- Dont pass zero length input to EVP_Cipher because assembler
  optimized AES cannot handle zero size. [bsc#1213517]
  * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1690891200">- Security fix: (bsc#1213853, CVE-2023-3817)
  * Fix excessive time spent checking DH q parameter value
    (bsc#1213853, CVE-2023-3817). The function DH_check() performs
    various checks on DH parameters. After fixing CVE-2023-3446 it
    was discovered that a large q parameter value can also trigger
    an overly long computation during some of these checks. A
    correct q value, if present, cannot be larger than the modulus
    p parameter, thus it is unnecessary to perform these checks if
    q is larger than p. If DH_check() is called with such q parameter
    value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
    computationally intensive checks are skipped.
  * Add openssl-1_1-CVE-2023-3817.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696420800">- Displays "fips" in the version string (bsc#1215215)
  * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch</changelog>
</package>
<package pkgid="4c0dfa75d0cc0fa7d9acba10a18f875dd8b06b58d06473c36cadd10ca285a508" name="libopenssl1_1-hmac" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150500.17.19.1"/>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1669982400">- POWER10 performance enhancements for cryptography [jsc#PED-512]
  * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch
  * openssl-1_1-Fixed-counter-overflow.patch
  * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch
  * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch
  * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">- FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685534400">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1686744000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Reworked the Fix for the Timing Oracle in RSA Decryption
    The previous fix for this timing side channel turned out to cause
    a severe 2-3x performance regression in the typical use case
    compared to 1.1.1s.
  * Add openssl-CVE-2022-4304.patch
  * Removed patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch
  * Refreshed patches:
  - openssl-CVE-2023-0464.patch
  - openssl-CVE-2023-0465.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1689854400">- Security fix: [bsc#1213487, CVE-2023-3446]
  * Fix DH_check() excessive time with over sized modulus.
  * The function DH_check() performs various checks on DH parameters.
    One of those checks confirms that the modulus ("p" parameter) is
    not too large. Trying to use a very large modulus is slow and
    OpenSSL will not normally use a modulus which is over 10,000 bits
    in length.
    However the DH_check() function checks numerous aspects of the
    key or parameters that have been supplied. Some of those checks
    use the supplied modulus value even if it has already been found
    to be too large.
    A new limit has been added to DH_check of 32,768 bits. Supplying
    a key/parameters with a modulus over this size will simply cause
    DH_check() to fail.
  * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1690200000">- Dont pass zero length input to EVP_Cipher because assembler
  optimized AES cannot handle zero size. [bsc#1213517]
  * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1690891200">- Security fix: (bsc#1213853, CVE-2023-3817)
  * Fix excessive time spent checking DH q parameter value
    (bsc#1213853, CVE-2023-3817). The function DH_check() performs
    various checks on DH parameters. After fixing CVE-2023-3446 it
    was discovered that a large q parameter value can also trigger
    an overly long computation during some of these checks. A
    correct q value, if present, cannot be larger than the modulus
    p parameter, thus it is unnecessary to perform these checks if
    q is larger than p. If DH_check() is called with such q parameter
    value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
    computationally intensive checks are skipped.
  * Add openssl-1_1-CVE-2023-3817.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696420800">- Displays "fips" in the version string (bsc#1215215)
  * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch</changelog>
</package>
<package pkgid="35d69831aa18dc7537c8a096587adf88792e6abe1ce8d04055f3b48dd0161d17" name="libpci3" arch="aarch64">
  <version epoch="0" ver="3.5.6" rel="150300.13.6.1"/>
  <changelog author="tchvatal@suse.com" date="1416312000">- Version bump to 3.3.0:
  * Device names exported by BIOS are displayed on Linux.
  * On Linux systems, HWDB is used to look up device names
    when our ID database gives no match. (More precisely,
    HWDB is consulted after local pci.ids, but before using
    network to query online pci.ids.) Thanks to Tom Gundersen
    for the initial patch.
  * Added experimental back-end for OS X / Darwin. Thanks to
    Richard Yao for providing it.
  * Filters now support matching by device class. Original
    patch by Matthew Wilcox, wrappers for ABI compatibility
    by me.
  * Interrupt Pin and Interrupt Line registers are displayed
    for bridge devices, too.
  * Several portability bugs have been fixed.
  * Several typos have been fixed. Also, use of questionable
    constructs in man pages has been reduced.
  * PCIe link capabilities now include the ASPMOptComp bit.
  * The "CRS Software Visibility" bit is now decoded properly.
  * Updated pci.ids to the current snapshot of the database.
- Refresh patch:
  * pciutils-endianh.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1441540800">- Update to 3.3.1
  * Removed hacks for backward compatibility with Linux libc5,
    which were breaking newer non-glibc Linux systems. Thanks
    to Felix Janda.
  * Display VirtIO vendor-specific capability. Patch by Gerd
    Hoffmann.
  * Fixed memory leak in name cache.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="mpluskal@suse.com" date="1447416000">- Update to 3.4.0
  * On Linux, we report NUMA nodes of devices.
  * The sysfs back-end does not die on read errors
    of optional attributes. Instead, a warning is produced.
  * Fixed several minor bugs.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="jengelh@inai.de" date="1448107200">- Summary update</changelog>
  <changelog author="tchvatal@suse.com" date="1452254400">- Version update to 3.4.1:
  * New capabilities decoded: Process Address Space, Page Request
    Interface, Enhanced Allocation. Thanks to David Daney and
    David Woodhouse.
  * DevCap SlotPowerLimit is now decoded for all components with
    upstream ports.</changelog>
  <changelog author="mpluskal@suse.com" date="1463745600">- Update to version 3.5.0:
  * New capabilities decoded: Downstream Port Containment,
    Precision Time Measurement. Thanks to Keith Busch and
    Jonathan Yong.
  * Domain numbers extended to 31 bits. This will be used by the
    Linux kernel on some machines in near future.
  * Enhanced allocation regions are now decoded on Linux.
  * The NetBSD back-end supports PCIe extended configuration space.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="mpluskal@suse.com" date="1464177600">- Update to version 3.5.1:
  * Fixed symbol versioning of pci_init().</changelog>
  <changelog author="mpluskal@suse.com" date="1488196800">- Update to version 3.5.4:
  * Previous version broke compilation on systems, for which
    lib/types.h did not provide a 64-bit integer type. It is
    provided everywhere now.
- Changes for version 3.5.3:
  * When lspci looks for Linux kernel modules, it uses the default
  path to module directory provided by libkmod. Previously,
  it tried to construct the path explicitly, which need not
  work on all systems.
  * Improved formatting of memory and I/O ranges behind a bridge.
  * PCIe link capabilities now display GEN4 speed (16GT/s).
  * PCIe device capabilities now show bits related to atomic
    operations.
- Changes for version 3.5.2:
  * The L1 power management capability is now decoded more
  thoroughly. Thanks to Rajat Jain for the patch.
  * The table of configuration registers used by setpci
  had a bug in the definition of SUBSYSTEM_VENDOR_ID.</changelog>
  <changelog author="aavindraa@gmail.com" date="1510401600">- Update to version 3.5.5
  * Better decoding of AER capability.
  * "Slot Implemented" flag is decoded for PCI/PCI-X to PCIe bridges.
  * Minor fixes of decoding other capabilities.
  * As usual, updated pci.ids to the current snapshot of the
    database.
- cleanup with spec-cleaner
- switch from ftp to https
- track signature</changelog>
  <changelog author="aavindraa@gmail.com" date="1511092800">- Update to version 3.5.6
  * MN VPD keyword is decoded correctly.
  * As usual, updated pci.ids to the current snapshot of the
    database.
  * FreeBSD back-end: read-only access for non-root, support
    DragonFly BSD, support extended config space.</changelog>
  <changelog author="msuchanek@suse.com" date="1590062400">- Fix lspci outputs few of the VPD data fields are displayed as unknown (bsc#1170554, ltc#185587).
  Added:
  * pciutils-VPD-When-printing-item-IDs-escape-non-ASCII-characte.patch
  * pciutils-VPD-Cleanup.patch
  * pciutils-Add-decoding-of-vendor-specific-VPD-fields.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603972800">- Add decode support for RCECs [jsc#SLE-13735]
- added patches
  https://github.com/pciutils/pciutils/commit/e12bd01eea67ca8cf539263124843ba281eb6ecc
  + pciutils-add-decode-support-for-RCECs.patch</changelog>
  <changelog author="vliaskovitis@suse.com" date="1643025600">- Add pciutils-Add-PCIe-5.0-data-rate-32-GT-s-support.patch
  Add pciutils-Add-PCIe-6.0-data-rate-64-GT-s-support.patch
  (bsc#1192862)</changelog>
  <changelog author="psimons@suse.com" date="1696420800">- Apply "lspci-Fixed-buffer-overflows-in-ls-tree.c.patch" to fix a
  buffer overflow error that would cause lspci to crash on systems
  with complex topologies. [bsc#1215265]
- Add "pciutils.keyring" so that the tarball's signature can be
  verified at build time.
- Use "%license" tag instead of "%doc" to install the package's
  license file.</changelog>
</package>
<package pkgid="e3d199d1397a78dbe612f534d6818657fb5cd9ebc2b591e2107c44586f7f2470" name="libpci3" arch="s390x">
  <version epoch="0" ver="3.5.6" rel="150300.13.6.1"/>
  <changelog author="tchvatal@suse.com" date="1416312000">- Version bump to 3.3.0:
  * Device names exported by BIOS are displayed on Linux.
  * On Linux systems, HWDB is used to look up device names
    when our ID database gives no match. (More precisely,
    HWDB is consulted after local pci.ids, but before using
    network to query online pci.ids.) Thanks to Tom Gundersen
    for the initial patch.
  * Added experimental back-end for OS X / Darwin. Thanks to
    Richard Yao for providing it.
  * Filters now support matching by device class. Original
    patch by Matthew Wilcox, wrappers for ABI compatibility
    by me.
  * Interrupt Pin and Interrupt Line registers are displayed
    for bridge devices, too.
  * Several portability bugs have been fixed.
  * Several typos have been fixed. Also, use of questionable
    constructs in man pages has been reduced.
  * PCIe link capabilities now include the ASPMOptComp bit.
  * The "CRS Software Visibility" bit is now decoded properly.
  * Updated pci.ids to the current snapshot of the database.
- Refresh patch:
  * pciutils-endianh.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1441540800">- Update to 3.3.1
  * Removed hacks for backward compatibility with Linux libc5,
    which were breaking newer non-glibc Linux systems. Thanks
    to Felix Janda.
  * Display VirtIO vendor-specific capability. Patch by Gerd
    Hoffmann.
  * Fixed memory leak in name cache.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="mpluskal@suse.com" date="1447416000">- Update to 3.4.0
  * On Linux, we report NUMA nodes of devices.
  * The sysfs back-end does not die on read errors
    of optional attributes. Instead, a warning is produced.
  * Fixed several minor bugs.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="jengelh@inai.de" date="1448107200">- Summary update</changelog>
  <changelog author="tchvatal@suse.com" date="1452254400">- Version update to 3.4.1:
  * New capabilities decoded: Process Address Space, Page Request
    Interface, Enhanced Allocation. Thanks to David Daney and
    David Woodhouse.
  * DevCap SlotPowerLimit is now decoded for all components with
    upstream ports.</changelog>
  <changelog author="mpluskal@suse.com" date="1463745600">- Update to version 3.5.0:
  * New capabilities decoded: Downstream Port Containment,
    Precision Time Measurement. Thanks to Keith Busch and
    Jonathan Yong.
  * Domain numbers extended to 31 bits. This will be used by the
    Linux kernel on some machines in near future.
  * Enhanced allocation regions are now decoded on Linux.
  * The NetBSD back-end supports PCIe extended configuration space.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="mpluskal@suse.com" date="1464177600">- Update to version 3.5.1:
  * Fixed symbol versioning of pci_init().</changelog>
  <changelog author="mpluskal@suse.com" date="1488196800">- Update to version 3.5.4:
  * Previous version broke compilation on systems, for which
    lib/types.h did not provide a 64-bit integer type. It is
    provided everywhere now.
- Changes for version 3.5.3:
  * When lspci looks for Linux kernel modules, it uses the default
  path to module directory provided by libkmod. Previously,
  it tried to construct the path explicitly, which need not
  work on all systems.
  * Improved formatting of memory and I/O ranges behind a bridge.
  * PCIe link capabilities now display GEN4 speed (16GT/s).
  * PCIe device capabilities now show bits related to atomic
    operations.
- Changes for version 3.5.2:
  * The L1 power management capability is now decoded more
  thoroughly. Thanks to Rajat Jain for the patch.
  * The table of configuration registers used by setpci
  had a bug in the definition of SUBSYSTEM_VENDOR_ID.</changelog>
  <changelog author="aavindraa@gmail.com" date="1510401600">- Update to version 3.5.5
  * Better decoding of AER capability.
  * "Slot Implemented" flag is decoded for PCI/PCI-X to PCIe bridges.
  * Minor fixes of decoding other capabilities.
  * As usual, updated pci.ids to the current snapshot of the
    database.
- cleanup with spec-cleaner
- switch from ftp to https
- track signature</changelog>
  <changelog author="aavindraa@gmail.com" date="1511092800">- Update to version 3.5.6
  * MN VPD keyword is decoded correctly.
  * As usual, updated pci.ids to the current snapshot of the
    database.
  * FreeBSD back-end: read-only access for non-root, support
    DragonFly BSD, support extended config space.</changelog>
  <changelog author="msuchanek@suse.com" date="1590062400">- Fix lspci outputs few of the VPD data fields are displayed as unknown (bsc#1170554, ltc#185587).
  Added:
  * pciutils-VPD-When-printing-item-IDs-escape-non-ASCII-characte.patch
  * pciutils-VPD-Cleanup.patch
  * pciutils-Add-decoding-of-vendor-specific-VPD-fields.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603972800">- Add decode support for RCECs [jsc#SLE-13735]
- added patches
  https://github.com/pciutils/pciutils/commit/e12bd01eea67ca8cf539263124843ba281eb6ecc
  + pciutils-add-decode-support-for-RCECs.patch</changelog>
  <changelog author="vliaskovitis@suse.com" date="1643025600">- Add pciutils-Add-PCIe-5.0-data-rate-32-GT-s-support.patch
  Add pciutils-Add-PCIe-6.0-data-rate-64-GT-s-support.patch
  (bsc#1192862)</changelog>
  <changelog author="psimons@suse.com" date="1696420800">- Apply "lspci-Fixed-buffer-overflows-in-ls-tree.c.patch" to fix a
  buffer overflow error that would cause lspci to crash on systems
  with complex topologies. [bsc#1215265]
- Add "pciutils.keyring" so that the tarball's signature can be
  verified at build time.
- Use "%license" tag instead of "%doc" to install the package's
  license file.</changelog>
</package>
<package pkgid="da2c4916f7a7352e8c0426e4fc12b9bb803773e1b6e09ca63f7443cd16e0b935" name="libpci3" arch="x86_64">
  <version epoch="0" ver="3.5.6" rel="150300.13.6.1"/>
  <changelog author="tchvatal@suse.com" date="1416312000">- Version bump to 3.3.0:
  * Device names exported by BIOS are displayed on Linux.
  * On Linux systems, HWDB is used to look up device names
    when our ID database gives no match. (More precisely,
    HWDB is consulted after local pci.ids, but before using
    network to query online pci.ids.) Thanks to Tom Gundersen
    for the initial patch.
  * Added experimental back-end for OS X / Darwin. Thanks to
    Richard Yao for providing it.
  * Filters now support matching by device class. Original
    patch by Matthew Wilcox, wrappers for ABI compatibility
    by me.
  * Interrupt Pin and Interrupt Line registers are displayed
    for bridge devices, too.
  * Several portability bugs have been fixed.
  * Several typos have been fixed. Also, use of questionable
    constructs in man pages has been reduced.
  * PCIe link capabilities now include the ASPMOptComp bit.
  * The "CRS Software Visibility" bit is now decoded properly.
  * Updated pci.ids to the current snapshot of the database.
- Refresh patch:
  * pciutils-endianh.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1441540800">- Update to 3.3.1
  * Removed hacks for backward compatibility with Linux libc5,
    which were breaking newer non-glibc Linux systems. Thanks
    to Felix Janda.
  * Display VirtIO vendor-specific capability. Patch by Gerd
    Hoffmann.
  * Fixed memory leak in name cache.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="mpluskal@suse.com" date="1447416000">- Update to 3.4.0
  * On Linux, we report NUMA nodes of devices.
  * The sysfs back-end does not die on read errors
    of optional attributes. Instead, a warning is produced.
  * Fixed several minor bugs.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="jengelh@inai.de" date="1448107200">- Summary update</changelog>
  <changelog author="tchvatal@suse.com" date="1452254400">- Version update to 3.4.1:
  * New capabilities decoded: Process Address Space, Page Request
    Interface, Enhanced Allocation. Thanks to David Daney and
    David Woodhouse.
  * DevCap SlotPowerLimit is now decoded for all components with
    upstream ports.</changelog>
  <changelog author="mpluskal@suse.com" date="1463745600">- Update to version 3.5.0:
  * New capabilities decoded: Downstream Port Containment,
    Precision Time Measurement. Thanks to Keith Busch and
    Jonathan Yong.
  * Domain numbers extended to 31 bits. This will be used by the
    Linux kernel on some machines in near future.
  * Enhanced allocation regions are now decoded on Linux.
  * The NetBSD back-end supports PCIe extended configuration space.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="mpluskal@suse.com" date="1464177600">- Update to version 3.5.1:
  * Fixed symbol versioning of pci_init().</changelog>
  <changelog author="mpluskal@suse.com" date="1488196800">- Update to version 3.5.4:
  * Previous version broke compilation on systems, for which
    lib/types.h did not provide a 64-bit integer type. It is
    provided everywhere now.
- Changes for version 3.5.3:
  * When lspci looks for Linux kernel modules, it uses the default
  path to module directory provided by libkmod. Previously,
  it tried to construct the path explicitly, which need not
  work on all systems.
  * Improved formatting of memory and I/O ranges behind a bridge.
  * PCIe link capabilities now display GEN4 speed (16GT/s).
  * PCIe device capabilities now show bits related to atomic
    operations.
- Changes for version 3.5.2:
  * The L1 power management capability is now decoded more
  thoroughly. Thanks to Rajat Jain for the patch.
  * The table of configuration registers used by setpci
  had a bug in the definition of SUBSYSTEM_VENDOR_ID.</changelog>
  <changelog author="aavindraa@gmail.com" date="1510401600">- Update to version 3.5.5
  * Better decoding of AER capability.
  * "Slot Implemented" flag is decoded for PCI/PCI-X to PCIe bridges.
  * Minor fixes of decoding other capabilities.
  * As usual, updated pci.ids to the current snapshot of the
    database.
- cleanup with spec-cleaner
- switch from ftp to https
- track signature</changelog>
  <changelog author="aavindraa@gmail.com" date="1511092800">- Update to version 3.5.6
  * MN VPD keyword is decoded correctly.
  * As usual, updated pci.ids to the current snapshot of the
    database.
  * FreeBSD back-end: read-only access for non-root, support
    DragonFly BSD, support extended config space.</changelog>
  <changelog author="msuchanek@suse.com" date="1590062400">- Fix lspci outputs few of the VPD data fields are displayed as unknown (bsc#1170554, ltc#185587).
  Added:
  * pciutils-VPD-When-printing-item-IDs-escape-non-ASCII-characte.patch
  * pciutils-VPD-Cleanup.patch
  * pciutils-Add-decoding-of-vendor-specific-VPD-fields.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603972800">- Add decode support for RCECs [jsc#SLE-13735]
- added patches
  https://github.com/pciutils/pciutils/commit/e12bd01eea67ca8cf539263124843ba281eb6ecc
  + pciutils-add-decode-support-for-RCECs.patch</changelog>
  <changelog author="vliaskovitis@suse.com" date="1643025600">- Add pciutils-Add-PCIe-5.0-data-rate-32-GT-s-support.patch
  Add pciutils-Add-PCIe-6.0-data-rate-64-GT-s-support.patch
  (bsc#1192862)</changelog>
  <changelog author="psimons@suse.com" date="1696420800">- Apply "lspci-Fixed-buffer-overflows-in-ls-tree.c.patch" to fix a
  buffer overflow error that would cause lspci to crash on systems
  with complex topologies. [bsc#1215265]
- Add "pciutils.keyring" so that the tarball's signature can be
  verified at build time.
- Use "%license" tag instead of "%doc" to install the package's
  license file.</changelog>
</package>
<package pkgid="af49a0c42313d763841cfcf321ff545a3377ccdd712bb5b3a2e3032cbd14502d" name="libpython3_6m1_0" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.51.1"/>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
  <changelog author="daniel.garcia@suse.com" date="1694433600">- Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing
  gh#python/cpython#108310, backport from upstream patch
  gh#python/cpython#108315
  (bsc#1214692, CVE-2023-40217)</changelog>
</package>
<package pkgid="7d73e4f72000198897e733a59de0d6b37d5e2dd0f379dbd1b5b60096c10b76f1" name="libpython3_6m1_0" arch="s390x">
  <version epoch="0" ver="3.6.15" rel="150300.10.51.1"/>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
  <changelog author="daniel.garcia@suse.com" date="1694433600">- Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing
  gh#python/cpython#108310, backport from upstream patch
  gh#python/cpython#108315
  (bsc#1214692, CVE-2023-40217)</changelog>
</package>
<package pkgid="d4065caa31a1a86fcc5d761c6cd78e334ea074b8c281e70784ec27d640423fd7" name="libpython3_6m1_0" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.51.1"/>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
  <changelog author="daniel.garcia@suse.com" date="1694433600">- Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing
  gh#python/cpython#108310, backport from upstream patch
  gh#python/cpython#108315
  (bsc#1214692, CVE-2023-40217)</changelog>
</package>
<package pkgid="1f53591e0037846b0a8f935dd0c2ef0a3b60888204ed5037ed38f82bc3449368" name="libssh2-1" arch="aarch64">
  <version epoch="0" ver="1.11.0" rel="150000.4.19.1"/>
  <changelog author="vcizek@suse.com" date="1426075200">- update to 1.5.0
  * fixes CVE-2015-1782 (bnc#921070)
- tarball verification
  * added libssh2_org.keyring
  * added libssh2-1.5.0.tar.gz.asc
  Changes in 1.5.0:
  Added Windows Cryptography API: Next Generation based backend
  Bug fixes:
  Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782
  missing _libssh2_error in _libssh2_channel_write
  knownhost: Fix DSS keys being detected as unknown.
  knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer.
  libssh2.h: on Windows, a socket is of type SOCKET, not int
  libssh2_priv.h: a 1 bit bit-field should be unsigned
  windows build: do not export externals from static library
  Fixed two potential use-after-frees of the payload buffer
  Fixed a few memory leaks in error paths
  userauth: Fixed an attempt to free from stack on error
  agent_list_identities: Fixed memory leak on OOM
  knownhosts: Abort if the hosts buffer is too small
  sftp_close_handle: ensure the handle is always closed
  channel_close: Close the channel even in the case of errors
  docs: added missing libssh2_session_handshake.3 file
  docs: fixed a bunch of typos
  userauth_password: pass on the underlying error code
  _libssh2_channel_forward_cancel: accessed struct after free
  _libssh2_packet_add: avoid using uninitialized memory
  _libssh2_channel_forward_cancel: avoid memory leaks on error
  _libssh2_channel_write: client spins on write when window full
  windows build: fix build errors
  publickey_packet_receive: avoid junk in returned pointers
  channel_receive_window_adjust: store windows size always
  userauth_hostbased_fromfile: zero assign to avoid uninitialized use
  configure: change LIBS not LDFLAGS when checking for libs
  agent_connect_unix: make sure there's a trailing zero
  MinGW build: Fixed redefine warnings.
  sftpdir.c: added authentication method detection.
  Watcom build: added support for WinCNG build.
  configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS
  sftp_statvfs: fix for servers not supporting statfvs extension
  knownhost.c: use LIBSSH2_FREE macro instead of free
  Fixed compilation using mingw-w64
  knownhost.c: fixed that 'key_type_len' may be used uninitialized
  configure: Display individual crypto backends on separate lines
  examples on Windows: check for WSAStartup return code
  examples on Windows: check for socket return code
  agent.c: check return code of MapViewOfFile
  kex.c: fix possible NULL pointer de-reference with session-&gt;kex
  packet.c: fix possible NULL pointer de-reference within listen_state
  tests on Windows: check for WSAStartup return code
  userauth.c: improve readability and clarity of for-loops
  examples on Windows: use native SOCKET-type instead of int
  packet.c: i &lt; 256 was always true and i would overflow to 0
  kex.c: make sure mlist is not set to NULL
  session.c: check return value of session_nonblock in debug mode
  session.c: check return value of session_nonblock during startup
  userauth.c: make sure that sp_len is positive and avoid overflows
  knownhost.c: fix use of uninitialized argument variable wrote
  openssl: initialise the digest context before calling EVP_DigestInit()
  libssh2_agent_init: init -&gt;fd to LIBSSH2_INVALID_SOCKET
  configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib
  configure.ac: Rework crypto library detection
  configure.ac: Reorder --with-* options in --help output
  configure.ac: Call zlib zlib and not libz in text but keep option names
  Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro
  sftp: seek: Don't flush buffers on same offset
  sftp: statvfs: Along error path, reset the correct 'state' variable.
  sftp: Add support for fsync (OpenSSH extension).
  _libssh2_channel_read: fix data drop when out of window
  comp_method_zlib_decomp: Improve buffer growing algorithm
  _libssh2_channel_read: Honour window_size_initial
  window_size: redid window handling for flow control reasons
  knownhosts: handle unknown key types</changelog>
  <changelog author="vcizek@suse.com" date="1434110400">- update to 1.6.0
  Changes:
    Added CMake build system
    Added libssh2_userauth_publickey_frommemory()
  Bug fixes:
    wait_socket: wrong use of difftime()
    userauth: Fixed prompt text no longer being copied to the prompts struct
    mingw build: allow to pass custom CFLAGS
    Let mansyntax.sh work regardless of where it is called from
    Init HMAC_CTX before using it
    direct_tcpip: Fixed channel write
    WinCNG: fixed backend breakage
    OpenSSL: caused by introducing libssh2_hmac_ctx_init
    userauth.c: fix possible dereferences of a null pointer
    wincng: Added explicit clear memory feature to WinCNG backend
    openssl.c: fix possible segfault in case EVP_DigestInit fails
    wincng: fix return code of libssh2_md5_init()
    kex: do not ignore failure of libssh2_sha1_init()
    scp: fix that scp_send may transmit not initialised memory
    scp.c: improved command length calculation
    nonblocking examples: fix warning about unused tvdiff on Mac OS X
    configure: make clear-memory default but WARN if backend unsupported
    OpenSSL: Enable use of OpenSSL that doesn't have DSA
    OpenSSL: Use correct no-blowfish #define
    kex: fix libgcrypt memory leaks of bignum
    libssh2_channel_open: more detailed error message
    wincng: fixed memleak in (block) cipher destructor</changelog>
  <changelog author="vcizek@suse.com" date="1456228800">- update to 1.7.0
  * Fixes CVE-2016-0787 (boo#967026)
  * Changes:
    libssh2_session_set_last_error: Add function
    mac: Add support for HMAC-SHA-256 and HMAC-SHA-512
    WinCNG: support for SHA256/512 HMAC
    kex: Added diffie-hellman-group-exchange-sha256 support
    OS/400 crypto library QC3 support
  * and many bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497441600">- Version update to 1.8.0:
  * support openssl-1.1
  * many bugfixes
- Fixes bsc#1042660
- Remove obsolete conditionals that are no longer needed</changelog>
  <changelog author="jengelh@inai.de" date="1498737600">- Remove --with-pic which is only for static libs</changelog>
  <changelog author="dimstar@opensuse.org" date="1516104000">- Drop openssh BuildRequires: this is only used for one of the
  minor self-tests.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1552305600">- Security fixes:
  * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport
    read allows out-of-bounds write with specially crafted payload
  - libssh2_org-CVE-2019-3855.patch
  * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard
    interactive handling allows out-of-bounds write with specially
    crafted payload
  - libssh2_org-CVE-2019-3856.patch
  * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to
    zero-byte allocation and out-of-bounds with specially crafted
    message channel request SSH packet
  - libssh2_org-CVE-2019-3857.patch
  * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading
    to an out-of-bounds read with a specially crafted SFTP packet
  - libssh2_org-CVE-2019-3858.patch
  * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially
    crafted payloads due to unchecked use of _libssh2_packet_require
    and _libssh2_packet_requirev
  - libssh2_org-CVE-2019-3859.patch
  * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially
    crafted SFTP packets
  - libssh2_org-CVE-2019-3860.patch
  * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially
    crafted SSH packets
  - libssh2_org-CVE-2019-3861.patch
  * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with
    specially crafted message channel request SSH packet
  - libssh2_org-CVE-2019-3862.patch
  * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate
    keyboard interactive allows out-of-bounds writes with specially
    crafted keyboard responses
  - libssh2_org-CVE-2019-3863.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1554811200">- Version update to 1.8.2: [bsc#1130103]
  Bug fixes:
  * Fixed the misapplied userauth patch that broke 1.8.1
  * moved the MAX size declarations from the public header</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1556280000">- Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103]
  - Added libssh2_org-CVE-2019-3859-fix.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1571832000">- Security fix: [bsc#1154862, CVE-2019-17498]
  * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in
    a bounds check that might lead to disclose sensitive information
    or cause a denial of service
  * Add patch libssh2_org-CVE-2019-17498.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1598529600">- Drop man and groff BuildRequires: both are no longer used in
  current versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1603713600">- Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922]
  Enhancements and bugfixes:
  * adds ECDSA keys and host key support when using OpenSSL
  * adds ED25519 key and host key support when using OpenSSL 1.1.1
  * adds OpenSSH style key file reading
  * adds AES CTR mode support when using WinCNG
  * adds PEM passphrase protected file support for Libgcrypt and WinCNG
  * adds SHA256 hostkey fingerprint
  * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path()
  * adds explicit zeroing of sensitive data in memory
  * adds additional bounds checks to network buffer reads
  * adds the ability to use the server default permissions when creating sftp directories
  * adds support for building with OpenSSL no engine flag
  * adds support for building with LibreSSL
  * increased sftp packet size to 256k
  * fixed oversized packet handling in sftp
  * fixed building with OpenSSL 1.1
  * fixed a possible crash if sftp stat gets an unexpected response
  * fixed incorrect parsing of the KEX preference string value
  * fixed conditional RSA and AES-CTR support
  * fixed a small memory leak during the key exchange process
  * fixed a possible memory leak of the ssh banner string
  * fixed various small memory leaks in the backends
  * fixed possible out of bounds read when parsing public keys from the server
  * fixed possible out of bounds read when parsing invalid PEM files
  * no longer null terminates the scp remote exec command
  * now handle errors when diffie hellman key pair generation fails
  * improved building instructions
  * improved unit tests
- Rebased patches:
  * libssh2-ocloexec.patch
  * libssh2_org-CVE-2019-17498.patch
- Remove patches fixed in this version:
  libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch
  libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch
  libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch
  libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch
  libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch</changelog>
  <changelog author="david.anes@suse.com" date="1639137600">- Bump to version 1.10.0
    Enhancements and bugfixes:
  * support ECDSA certificate authentication
  * fix detailed _libssh2_error being overwritten by generic errors
  * unified error handling
  * fix _libssh2_random() silently discarding errors
  * don't error if using keys without RSA
  * avoid OpenSSL latent error in FIPS mode
  * fix EVP_Cipher interface change in openssl 3
  * fix potential overwrite of buffer when reading stdout of command
  * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data
  * correct a typo which may lead to stack overflow
  * fix random big number generation to match openssl
  * added key exchange group16-sha512 and group18-sha512.
  * add support for an OSS Fuzzer fuzzing target
  * adds support for ECDSA for both key exchange and host key algorithms
  * clean up curve25519 code
  * update the min, preferred and max DH group values based on RFC 8270.
  * changed type of LIBSSH2_FX_* constants to unsigned long
  * added diffie-hellman-group14-sha256 kex
  * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression
  * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x.
  * fixes crash with delayed compression option using Bitvise server.
  * adds support for PKIX key reading
  * use new API to parse data in packet_x11_open() for better bounds checking.
  * double the static buffer size when reading and writing known hosts
  * improved bounds checking in packet_queue_listener
  * improve message parsing (CVE-2019-17498)
  * improve bounds checking in kex_agree_methods()
  * adding SSH agent forwarding.
  * fix agent forwarding message, updated example.
  * added integration test code and cmake target. Added example to cmake list.
  * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero.
  * add an EWOULDBLOCK check for better portability
  * fix off by one error when loading public keys with no id
  * fix use-after-free crash on reinitialization of openssl backend
  * preserve error info from agent_list_identities()
  * make sure the error code is set in _libssh2_channel_open()
  * fixed misspellings
  * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type`
  * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type
- Rebased patch libssh2-ocloexec.path
- Removed patch libssh2_org-CVE-2019-17498.patch: the security fix
    is already included in the latest version.</changelog>
  <changelog author="pmonreal@suse.com" date="1687262400">- Update to 1.11.0:
  * Enhancements and bugfixes
  - Adds support for encrypt-then-mac (ETM) MACs
  - Adds support for AES-GCM crypto protocols
  - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys
  - Adds support for RSA certificate authentication
  - Adds FIDO support with *_sk() functions
  - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends
  - Adds Agent Forwarding and libssh2_agent_sign()
  - Adds support for Channel Signal message libssh2_channel_signal_ex()
  - Adds support to get the user auth banner message libssh2_userauth_banner()
  - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519,
    AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options
  - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex()
  - Adds wolfSSL support to CMake file
  - Adds mbedTLS 3.x support
  - Adds LibreSSL 3.5 support
  - Adds support for CMake "unity" builds
  - Adds CMake support for building shared and static libs in a single pass
  - Adds symbol hiding support to CMake
  - Adds support for libssh2.rc for all build tools
  - Adds .zip, .tar.xz and .tar.bz2 release tarballs
  - Enables ed25519 key support for LibreSSL 3.7.0 or higher
  - Improves OpenSSL 1.1 and 3 compatibility
  - Now requires OpenSSL 1.0.2 or newer
  - Now requires CMake 3.1 or newer
  - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs
  - SFTP: No longer has a packet limit when reading a directory
  - SFTP: now parses attribute extensions if they exist
  - SFTP: no longer will busy loop if SFTP fails to initialize
  - SFTP: now clear various errors as expected
  - SFTP: no longer skips files if the line buffer is too small
  - SCP: add option to not quote paths
  - SCP: Enables 64-bit offset support unconditionally
  - Now skips leading \r and \n characters in banner_receive()
  - Enables secure memory zeroing with all build tools on all platforms
  - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive
  - Speed up base64 encoding by 7x
  - Assert if there is an attempt to write a value that is too large
  - WinCNG: fix memory leak in _libssh2_dh_secret()
  - Added protection against possible null pointer dereferences
  - Agent now handles overly large comment lengths
  - Now ensure KEX replies don't include extra bytes
  - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER
  - Fixed possible buffer overflow in keyboard interactive code path
  - Fixed overlapping memcpy()
  - Fixed Windows UWP builds
  - Fixed DLL import name
  - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows
  - Support for building with gcc versions older than 8
  - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files
  - Restores ANSI C89 compliance
  - Enabled new compiler warnings and fixed/silenced them
  - Improved error messages
  - Now uses CIFuzz
  - Numerous minor code improvements
  - Improvements to CI builds
  - Improvements to unit tests
  - Improvements to doc files
  - Improvements to example files
  - Removed "old gex" build option
  - Removed no-encryption/no-mac builds
  - Removed support for NetWare and Watcom wmake build files
  * Rebase libssh2-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1693224000">- Security fix: [bsc#1214527, CVE-2020-22218]
  * The function _libssh2_packet_add() allows to access out of
    bounds memory.
  * Add libssh2_org-CVE-2020-22218.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1695038400">- Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040]
  * Add the keyring file: libssh2_org.keyring
  * Rebase libssh2-ocloexec.patch
  * Remove libssh2_org-CVE-2020-22218.patch</changelog>
</package>
<package pkgid="eaa68c1cf7161593c0a7bb7e09329652795ad8966935a4c4c1457a5d766469c8" name="libssh2-1" arch="s390x">
  <version epoch="0" ver="1.11.0" rel="150000.4.19.1"/>
  <changelog author="vcizek@suse.com" date="1426075200">- update to 1.5.0
  * fixes CVE-2015-1782 (bnc#921070)
- tarball verification
  * added libssh2_org.keyring
  * added libssh2-1.5.0.tar.gz.asc
  Changes in 1.5.0:
  Added Windows Cryptography API: Next Generation based backend
  Bug fixes:
  Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782
  missing _libssh2_error in _libssh2_channel_write
  knownhost: Fix DSS keys being detected as unknown.
  knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer.
  libssh2.h: on Windows, a socket is of type SOCKET, not int
  libssh2_priv.h: a 1 bit bit-field should be unsigned
  windows build: do not export externals from static library
  Fixed two potential use-after-frees of the payload buffer
  Fixed a few memory leaks in error paths
  userauth: Fixed an attempt to free from stack on error
  agent_list_identities: Fixed memory leak on OOM
  knownhosts: Abort if the hosts buffer is too small
  sftp_close_handle: ensure the handle is always closed
  channel_close: Close the channel even in the case of errors
  docs: added missing libssh2_session_handshake.3 file
  docs: fixed a bunch of typos
  userauth_password: pass on the underlying error code
  _libssh2_channel_forward_cancel: accessed struct after free
  _libssh2_packet_add: avoid using uninitialized memory
  _libssh2_channel_forward_cancel: avoid memory leaks on error
  _libssh2_channel_write: client spins on write when window full
  windows build: fix build errors
  publickey_packet_receive: avoid junk in returned pointers
  channel_receive_window_adjust: store windows size always
  userauth_hostbased_fromfile: zero assign to avoid uninitialized use
  configure: change LIBS not LDFLAGS when checking for libs
  agent_connect_unix: make sure there's a trailing zero
  MinGW build: Fixed redefine warnings.
  sftpdir.c: added authentication method detection.
  Watcom build: added support for WinCNG build.
  configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS
  sftp_statvfs: fix for servers not supporting statfvs extension
  knownhost.c: use LIBSSH2_FREE macro instead of free
  Fixed compilation using mingw-w64
  knownhost.c: fixed that 'key_type_len' may be used uninitialized
  configure: Display individual crypto backends on separate lines
  examples on Windows: check for WSAStartup return code
  examples on Windows: check for socket return code
  agent.c: check return code of MapViewOfFile
  kex.c: fix possible NULL pointer de-reference with session-&gt;kex
  packet.c: fix possible NULL pointer de-reference within listen_state
  tests on Windows: check for WSAStartup return code
  userauth.c: improve readability and clarity of for-loops
  examples on Windows: use native SOCKET-type instead of int
  packet.c: i &lt; 256 was always true and i would overflow to 0
  kex.c: make sure mlist is not set to NULL
  session.c: check return value of session_nonblock in debug mode
  session.c: check return value of session_nonblock during startup
  userauth.c: make sure that sp_len is positive and avoid overflows
  knownhost.c: fix use of uninitialized argument variable wrote
  openssl: initialise the digest context before calling EVP_DigestInit()
  libssh2_agent_init: init -&gt;fd to LIBSSH2_INVALID_SOCKET
  configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib
  configure.ac: Rework crypto library detection
  configure.ac: Reorder --with-* options in --help output
  configure.ac: Call zlib zlib and not libz in text but keep option names
  Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro
  sftp: seek: Don't flush buffers on same offset
  sftp: statvfs: Along error path, reset the correct 'state' variable.
  sftp: Add support for fsync (OpenSSH extension).
  _libssh2_channel_read: fix data drop when out of window
  comp_method_zlib_decomp: Improve buffer growing algorithm
  _libssh2_channel_read: Honour window_size_initial
  window_size: redid window handling for flow control reasons
  knownhosts: handle unknown key types</changelog>
  <changelog author="vcizek@suse.com" date="1434110400">- update to 1.6.0
  Changes:
    Added CMake build system
    Added libssh2_userauth_publickey_frommemory()
  Bug fixes:
    wait_socket: wrong use of difftime()
    userauth: Fixed prompt text no longer being copied to the prompts struct
    mingw build: allow to pass custom CFLAGS
    Let mansyntax.sh work regardless of where it is called from
    Init HMAC_CTX before using it
    direct_tcpip: Fixed channel write
    WinCNG: fixed backend breakage
    OpenSSL: caused by introducing libssh2_hmac_ctx_init
    userauth.c: fix possible dereferences of a null pointer
    wincng: Added explicit clear memory feature to WinCNG backend
    openssl.c: fix possible segfault in case EVP_DigestInit fails
    wincng: fix return code of libssh2_md5_init()
    kex: do not ignore failure of libssh2_sha1_init()
    scp: fix that scp_send may transmit not initialised memory
    scp.c: improved command length calculation
    nonblocking examples: fix warning about unused tvdiff on Mac OS X
    configure: make clear-memory default but WARN if backend unsupported
    OpenSSL: Enable use of OpenSSL that doesn't have DSA
    OpenSSL: Use correct no-blowfish #define
    kex: fix libgcrypt memory leaks of bignum
    libssh2_channel_open: more detailed error message
    wincng: fixed memleak in (block) cipher destructor</changelog>
  <changelog author="vcizek@suse.com" date="1456228800">- update to 1.7.0
  * Fixes CVE-2016-0787 (boo#967026)
  * Changes:
    libssh2_session_set_last_error: Add function
    mac: Add support for HMAC-SHA-256 and HMAC-SHA-512
    WinCNG: support for SHA256/512 HMAC
    kex: Added diffie-hellman-group-exchange-sha256 support
    OS/400 crypto library QC3 support
  * and many bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497441600">- Version update to 1.8.0:
  * support openssl-1.1
  * many bugfixes
- Fixes bsc#1042660
- Remove obsolete conditionals that are no longer needed</changelog>
  <changelog author="jengelh@inai.de" date="1498737600">- Remove --with-pic which is only for static libs</changelog>
  <changelog author="dimstar@opensuse.org" date="1516104000">- Drop openssh BuildRequires: this is only used for one of the
  minor self-tests.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1552305600">- Security fixes:
  * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport
    read allows out-of-bounds write with specially crafted payload
  - libssh2_org-CVE-2019-3855.patch
  * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard
    interactive handling allows out-of-bounds write with specially
    crafted payload
  - libssh2_org-CVE-2019-3856.patch
  * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to
    zero-byte allocation and out-of-bounds with specially crafted
    message channel request SSH packet
  - libssh2_org-CVE-2019-3857.patch
  * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading
    to an out-of-bounds read with a specially crafted SFTP packet
  - libssh2_org-CVE-2019-3858.patch
  * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially
    crafted payloads due to unchecked use of _libssh2_packet_require
    and _libssh2_packet_requirev
  - libssh2_org-CVE-2019-3859.patch
  * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially
    crafted SFTP packets
  - libssh2_org-CVE-2019-3860.patch
  * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially
    crafted SSH packets
  - libssh2_org-CVE-2019-3861.patch
  * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with
    specially crafted message channel request SSH packet
  - libssh2_org-CVE-2019-3862.patch
  * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate
    keyboard interactive allows out-of-bounds writes with specially
    crafted keyboard responses
  - libssh2_org-CVE-2019-3863.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1554811200">- Version update to 1.8.2: [bsc#1130103]
  Bug fixes:
  * Fixed the misapplied userauth patch that broke 1.8.1
  * moved the MAX size declarations from the public header</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1556280000">- Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103]
  - Added libssh2_org-CVE-2019-3859-fix.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1571832000">- Security fix: [bsc#1154862, CVE-2019-17498]
  * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in
    a bounds check that might lead to disclose sensitive information
    or cause a denial of service
  * Add patch libssh2_org-CVE-2019-17498.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1598529600">- Drop man and groff BuildRequires: both are no longer used in
  current versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1603713600">- Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922]
  Enhancements and bugfixes:
  * adds ECDSA keys and host key support when using OpenSSL
  * adds ED25519 key and host key support when using OpenSSL 1.1.1
  * adds OpenSSH style key file reading
  * adds AES CTR mode support when using WinCNG
  * adds PEM passphrase protected file support for Libgcrypt and WinCNG
  * adds SHA256 hostkey fingerprint
  * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path()
  * adds explicit zeroing of sensitive data in memory
  * adds additional bounds checks to network buffer reads
  * adds the ability to use the server default permissions when creating sftp directories
  * adds support for building with OpenSSL no engine flag
  * adds support for building with LibreSSL
  * increased sftp packet size to 256k
  * fixed oversized packet handling in sftp
  * fixed building with OpenSSL 1.1
  * fixed a possible crash if sftp stat gets an unexpected response
  * fixed incorrect parsing of the KEX preference string value
  * fixed conditional RSA and AES-CTR support
  * fixed a small memory leak during the key exchange process
  * fixed a possible memory leak of the ssh banner string
  * fixed various small memory leaks in the backends
  * fixed possible out of bounds read when parsing public keys from the server
  * fixed possible out of bounds read when parsing invalid PEM files
  * no longer null terminates the scp remote exec command
  * now handle errors when diffie hellman key pair generation fails
  * improved building instructions
  * improved unit tests
- Rebased patches:
  * libssh2-ocloexec.patch
  * libssh2_org-CVE-2019-17498.patch
- Remove patches fixed in this version:
  libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch
  libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch
  libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch
  libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch
  libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch</changelog>
  <changelog author="david.anes@suse.com" date="1639137600">- Bump to version 1.10.0
    Enhancements and bugfixes:
  * support ECDSA certificate authentication
  * fix detailed _libssh2_error being overwritten by generic errors
  * unified error handling
  * fix _libssh2_random() silently discarding errors
  * don't error if using keys without RSA
  * avoid OpenSSL latent error in FIPS mode
  * fix EVP_Cipher interface change in openssl 3
  * fix potential overwrite of buffer when reading stdout of command
  * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data
  * correct a typo which may lead to stack overflow
  * fix random big number generation to match openssl
  * added key exchange group16-sha512 and group18-sha512.
  * add support for an OSS Fuzzer fuzzing target
  * adds support for ECDSA for both key exchange and host key algorithms
  * clean up curve25519 code
  * update the min, preferred and max DH group values based on RFC 8270.
  * changed type of LIBSSH2_FX_* constants to unsigned long
  * added diffie-hellman-group14-sha256 kex
  * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression
  * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x.
  * fixes crash with delayed compression option using Bitvise server.
  * adds support for PKIX key reading
  * use new API to parse data in packet_x11_open() for better bounds checking.
  * double the static buffer size when reading and writing known hosts
  * improved bounds checking in packet_queue_listener
  * improve message parsing (CVE-2019-17498)
  * improve bounds checking in kex_agree_methods()
  * adding SSH agent forwarding.
  * fix agent forwarding message, updated example.
  * added integration test code and cmake target. Added example to cmake list.
  * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero.
  * add an EWOULDBLOCK check for better portability
  * fix off by one error when loading public keys with no id
  * fix use-after-free crash on reinitialization of openssl backend
  * preserve error info from agent_list_identities()
  * make sure the error code is set in _libssh2_channel_open()
  * fixed misspellings
  * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type`
  * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type
- Rebased patch libssh2-ocloexec.path
- Removed patch libssh2_org-CVE-2019-17498.patch: the security fix
    is already included in the latest version.</changelog>
  <changelog author="pmonreal@suse.com" date="1687262400">- Update to 1.11.0:
  * Enhancements and bugfixes
  - Adds support for encrypt-then-mac (ETM) MACs
  - Adds support for AES-GCM crypto protocols
  - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys
  - Adds support for RSA certificate authentication
  - Adds FIDO support with *_sk() functions
  - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends
  - Adds Agent Forwarding and libssh2_agent_sign()
  - Adds support for Channel Signal message libssh2_channel_signal_ex()
  - Adds support to get the user auth banner message libssh2_userauth_banner()
  - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519,
    AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options
  - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex()
  - Adds wolfSSL support to CMake file
  - Adds mbedTLS 3.x support
  - Adds LibreSSL 3.5 support
  - Adds support for CMake "unity" builds
  - Adds CMake support for building shared and static libs in a single pass
  - Adds symbol hiding support to CMake
  - Adds support for libssh2.rc for all build tools
  - Adds .zip, .tar.xz and .tar.bz2 release tarballs
  - Enables ed25519 key support for LibreSSL 3.7.0 or higher
  - Improves OpenSSL 1.1 and 3 compatibility
  - Now requires OpenSSL 1.0.2 or newer
  - Now requires CMake 3.1 or newer
  - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs
  - SFTP: No longer has a packet limit when reading a directory
  - SFTP: now parses attribute extensions if they exist
  - SFTP: no longer will busy loop if SFTP fails to initialize
  - SFTP: now clear various errors as expected
  - SFTP: no longer skips files if the line buffer is too small
  - SCP: add option to not quote paths
  - SCP: Enables 64-bit offset support unconditionally
  - Now skips leading \r and \n characters in banner_receive()
  - Enables secure memory zeroing with all build tools on all platforms
  - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive
  - Speed up base64 encoding by 7x
  - Assert if there is an attempt to write a value that is too large
  - WinCNG: fix memory leak in _libssh2_dh_secret()
  - Added protection against possible null pointer dereferences
  - Agent now handles overly large comment lengths
  - Now ensure KEX replies don't include extra bytes
  - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER
  - Fixed possible buffer overflow in keyboard interactive code path
  - Fixed overlapping memcpy()
  - Fixed Windows UWP builds
  - Fixed DLL import name
  - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows
  - Support for building with gcc versions older than 8
  - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files
  - Restores ANSI C89 compliance
  - Enabled new compiler warnings and fixed/silenced them
  - Improved error messages
  - Now uses CIFuzz
  - Numerous minor code improvements
  - Improvements to CI builds
  - Improvements to unit tests
  - Improvements to doc files
  - Improvements to example files
  - Removed "old gex" build option
  - Removed no-encryption/no-mac builds
  - Removed support for NetWare and Watcom wmake build files
  * Rebase libssh2-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1693224000">- Security fix: [bsc#1214527, CVE-2020-22218]
  * The function _libssh2_packet_add() allows to access out of
    bounds memory.
  * Add libssh2_org-CVE-2020-22218.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1695038400">- Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040]
  * Add the keyring file: libssh2_org.keyring
  * Rebase libssh2-ocloexec.patch
  * Remove libssh2_org-CVE-2020-22218.patch</changelog>
</package>
<package pkgid="291590f6d5e84f8ad50960aa756501984c9fff723159d3533577fcec5735aec6" name="libssh2-1" arch="x86_64">
  <version epoch="0" ver="1.11.0" rel="150000.4.19.1"/>
  <changelog author="vcizek@suse.com" date="1426075200">- update to 1.5.0
  * fixes CVE-2015-1782 (bnc#921070)
- tarball verification
  * added libssh2_org.keyring
  * added libssh2-1.5.0.tar.gz.asc
  Changes in 1.5.0:
  Added Windows Cryptography API: Next Generation based backend
  Bug fixes:
  Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782
  missing _libssh2_error in _libssh2_channel_write
  knownhost: Fix DSS keys being detected as unknown.
  knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer.
  libssh2.h: on Windows, a socket is of type SOCKET, not int
  libssh2_priv.h: a 1 bit bit-field should be unsigned
  windows build: do not export externals from static library
  Fixed two potential use-after-frees of the payload buffer
  Fixed a few memory leaks in error paths
  userauth: Fixed an attempt to free from stack on error
  agent_list_identities: Fixed memory leak on OOM
  knownhosts: Abort if the hosts buffer is too small
  sftp_close_handle: ensure the handle is always closed
  channel_close: Close the channel even in the case of errors
  docs: added missing libssh2_session_handshake.3 file
  docs: fixed a bunch of typos
  userauth_password: pass on the underlying error code
  _libssh2_channel_forward_cancel: accessed struct after free
  _libssh2_packet_add: avoid using uninitialized memory
  _libssh2_channel_forward_cancel: avoid memory leaks on error
  _libssh2_channel_write: client spins on write when window full
  windows build: fix build errors
  publickey_packet_receive: avoid junk in returned pointers
  channel_receive_window_adjust: store windows size always
  userauth_hostbased_fromfile: zero assign to avoid uninitialized use
  configure: change LIBS not LDFLAGS when checking for libs
  agent_connect_unix: make sure there's a trailing zero
  MinGW build: Fixed redefine warnings.
  sftpdir.c: added authentication method detection.
  Watcom build: added support for WinCNG build.
  configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS
  sftp_statvfs: fix for servers not supporting statfvs extension
  knownhost.c: use LIBSSH2_FREE macro instead of free
  Fixed compilation using mingw-w64
  knownhost.c: fixed that 'key_type_len' may be used uninitialized
  configure: Display individual crypto backends on separate lines
  examples on Windows: check for WSAStartup return code
  examples on Windows: check for socket return code
  agent.c: check return code of MapViewOfFile
  kex.c: fix possible NULL pointer de-reference with session-&gt;kex
  packet.c: fix possible NULL pointer de-reference within listen_state
  tests on Windows: check for WSAStartup return code
  userauth.c: improve readability and clarity of for-loops
  examples on Windows: use native SOCKET-type instead of int
  packet.c: i &lt; 256 was always true and i would overflow to 0
  kex.c: make sure mlist is not set to NULL
  session.c: check return value of session_nonblock in debug mode
  session.c: check return value of session_nonblock during startup
  userauth.c: make sure that sp_len is positive and avoid overflows
  knownhost.c: fix use of uninitialized argument variable wrote
  openssl: initialise the digest context before calling EVP_DigestInit()
  libssh2_agent_init: init -&gt;fd to LIBSSH2_INVALID_SOCKET
  configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib
  configure.ac: Rework crypto library detection
  configure.ac: Reorder --with-* options in --help output
  configure.ac: Call zlib zlib and not libz in text but keep option names
  Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro
  sftp: seek: Don't flush buffers on same offset
  sftp: statvfs: Along error path, reset the correct 'state' variable.
  sftp: Add support for fsync (OpenSSH extension).
  _libssh2_channel_read: fix data drop when out of window
  comp_method_zlib_decomp: Improve buffer growing algorithm
  _libssh2_channel_read: Honour window_size_initial
  window_size: redid window handling for flow control reasons
  knownhosts: handle unknown key types</changelog>
  <changelog author="vcizek@suse.com" date="1434110400">- update to 1.6.0
  Changes:
    Added CMake build system
    Added libssh2_userauth_publickey_frommemory()
  Bug fixes:
    wait_socket: wrong use of difftime()
    userauth: Fixed prompt text no longer being copied to the prompts struct
    mingw build: allow to pass custom CFLAGS
    Let mansyntax.sh work regardless of where it is called from
    Init HMAC_CTX before using it
    direct_tcpip: Fixed channel write
    WinCNG: fixed backend breakage
    OpenSSL: caused by introducing libssh2_hmac_ctx_init
    userauth.c: fix possible dereferences of a null pointer
    wincng: Added explicit clear memory feature to WinCNG backend
    openssl.c: fix possible segfault in case EVP_DigestInit fails
    wincng: fix return code of libssh2_md5_init()
    kex: do not ignore failure of libssh2_sha1_init()
    scp: fix that scp_send may transmit not initialised memory
    scp.c: improved command length calculation
    nonblocking examples: fix warning about unused tvdiff on Mac OS X
    configure: make clear-memory default but WARN if backend unsupported
    OpenSSL: Enable use of OpenSSL that doesn't have DSA
    OpenSSL: Use correct no-blowfish #define
    kex: fix libgcrypt memory leaks of bignum
    libssh2_channel_open: more detailed error message
    wincng: fixed memleak in (block) cipher destructor</changelog>
  <changelog author="vcizek@suse.com" date="1456228800">- update to 1.7.0
  * Fixes CVE-2016-0787 (boo#967026)
  * Changes:
    libssh2_session_set_last_error: Add function
    mac: Add support for HMAC-SHA-256 and HMAC-SHA-512
    WinCNG: support for SHA256/512 HMAC
    kex: Added diffie-hellman-group-exchange-sha256 support
    OS/400 crypto library QC3 support
  * and many bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497441600">- Version update to 1.8.0:
  * support openssl-1.1
  * many bugfixes
- Fixes bsc#1042660
- Remove obsolete conditionals that are no longer needed</changelog>
  <changelog author="jengelh@inai.de" date="1498737600">- Remove --with-pic which is only for static libs</changelog>
  <changelog author="dimstar@opensuse.org" date="1516104000">- Drop openssh BuildRequires: this is only used for one of the
  minor self-tests.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1552305600">- Security fixes:
  * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport
    read allows out-of-bounds write with specially crafted payload
  - libssh2_org-CVE-2019-3855.patch
  * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard
    interactive handling allows out-of-bounds write with specially
    crafted payload
  - libssh2_org-CVE-2019-3856.patch
  * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to
    zero-byte allocation and out-of-bounds with specially crafted
    message channel request SSH packet
  - libssh2_org-CVE-2019-3857.patch
  * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading
    to an out-of-bounds read with a specially crafted SFTP packet
  - libssh2_org-CVE-2019-3858.patch
  * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially
    crafted payloads due to unchecked use of _libssh2_packet_require
    and _libssh2_packet_requirev
  - libssh2_org-CVE-2019-3859.patch
  * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially
    crafted SFTP packets
  - libssh2_org-CVE-2019-3860.patch
  * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially
    crafted SSH packets
  - libssh2_org-CVE-2019-3861.patch
  * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with
    specially crafted message channel request SSH packet
  - libssh2_org-CVE-2019-3862.patch
  * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate
    keyboard interactive allows out-of-bounds writes with specially
    crafted keyboard responses
  - libssh2_org-CVE-2019-3863.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1554811200">- Version update to 1.8.2: [bsc#1130103]
  Bug fixes:
  * Fixed the misapplied userauth patch that broke 1.8.1
  * moved the MAX size declarations from the public header</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1556280000">- Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103]
  - Added libssh2_org-CVE-2019-3859-fix.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1571832000">- Security fix: [bsc#1154862, CVE-2019-17498]
  * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in
    a bounds check that might lead to disclose sensitive information
    or cause a denial of service
  * Add patch libssh2_org-CVE-2019-17498.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1598529600">- Drop man and groff BuildRequires: both are no longer used in
  current versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1603713600">- Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922]
  Enhancements and bugfixes:
  * adds ECDSA keys and host key support when using OpenSSL
  * adds ED25519 key and host key support when using OpenSSL 1.1.1
  * adds OpenSSH style key file reading
  * adds AES CTR mode support when using WinCNG
  * adds PEM passphrase protected file support for Libgcrypt and WinCNG
  * adds SHA256 hostkey fingerprint
  * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path()
  * adds explicit zeroing of sensitive data in memory
  * adds additional bounds checks to network buffer reads
  * adds the ability to use the server default permissions when creating sftp directories
  * adds support for building with OpenSSL no engine flag
  * adds support for building with LibreSSL
  * increased sftp packet size to 256k
  * fixed oversized packet handling in sftp
  * fixed building with OpenSSL 1.1
  * fixed a possible crash if sftp stat gets an unexpected response
  * fixed incorrect parsing of the KEX preference string value
  * fixed conditional RSA and AES-CTR support
  * fixed a small memory leak during the key exchange process
  * fixed a possible memory leak of the ssh banner string
  * fixed various small memory leaks in the backends
  * fixed possible out of bounds read when parsing public keys from the server
  * fixed possible out of bounds read when parsing invalid PEM files
  * no longer null terminates the scp remote exec command
  * now handle errors when diffie hellman key pair generation fails
  * improved building instructions
  * improved unit tests
- Rebased patches:
  * libssh2-ocloexec.patch
  * libssh2_org-CVE-2019-17498.patch
- Remove patches fixed in this version:
  libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch
  libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch
  libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch
  libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch
  libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch</changelog>
  <changelog author="david.anes@suse.com" date="1639137600">- Bump to version 1.10.0
    Enhancements and bugfixes:
  * support ECDSA certificate authentication
  * fix detailed _libssh2_error being overwritten by generic errors
  * unified error handling
  * fix _libssh2_random() silently discarding errors
  * don't error if using keys without RSA
  * avoid OpenSSL latent error in FIPS mode
  * fix EVP_Cipher interface change in openssl 3
  * fix potential overwrite of buffer when reading stdout of command
  * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data
  * correct a typo which may lead to stack overflow
  * fix random big number generation to match openssl
  * added key exchange group16-sha512 and group18-sha512.
  * add support for an OSS Fuzzer fuzzing target
  * adds support for ECDSA for both key exchange and host key algorithms
  * clean up curve25519 code
  * update the min, preferred and max DH group values based on RFC 8270.
  * changed type of LIBSSH2_FX_* constants to unsigned long
  * added diffie-hellman-group14-sha256 kex
  * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression
  * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x.
  * fixes crash with delayed compression option using Bitvise server.
  * adds support for PKIX key reading
  * use new API to parse data in packet_x11_open() for better bounds checking.
  * double the static buffer size when reading and writing known hosts
  * improved bounds checking in packet_queue_listener
  * improve message parsing (CVE-2019-17498)
  * improve bounds checking in kex_agree_methods()
  * adding SSH agent forwarding.
  * fix agent forwarding message, updated example.
  * added integration test code and cmake target. Added example to cmake list.
  * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero.
  * add an EWOULDBLOCK check for better portability
  * fix off by one error when loading public keys with no id
  * fix use-after-free crash on reinitialization of openssl backend
  * preserve error info from agent_list_identities()
  * make sure the error code is set in _libssh2_channel_open()
  * fixed misspellings
  * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type`
  * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type
- Rebased patch libssh2-ocloexec.path
- Removed patch libssh2_org-CVE-2019-17498.patch: the security fix
    is already included in the latest version.</changelog>
  <changelog author="pmonreal@suse.com" date="1687262400">- Update to 1.11.0:
  * Enhancements and bugfixes
  - Adds support for encrypt-then-mac (ETM) MACs
  - Adds support for AES-GCM crypto protocols
  - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys
  - Adds support for RSA certificate authentication
  - Adds FIDO support with *_sk() functions
  - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends
  - Adds Agent Forwarding and libssh2_agent_sign()
  - Adds support for Channel Signal message libssh2_channel_signal_ex()
  - Adds support to get the user auth banner message libssh2_userauth_banner()
  - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519,
    AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options
  - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex()
  - Adds wolfSSL support to CMake file
  - Adds mbedTLS 3.x support
  - Adds LibreSSL 3.5 support
  - Adds support for CMake "unity" builds
  - Adds CMake support for building shared and static libs in a single pass
  - Adds symbol hiding support to CMake
  - Adds support for libssh2.rc for all build tools
  - Adds .zip, .tar.xz and .tar.bz2 release tarballs
  - Enables ed25519 key support for LibreSSL 3.7.0 or higher
  - Improves OpenSSL 1.1 and 3 compatibility
  - Now requires OpenSSL 1.0.2 or newer
  - Now requires CMake 3.1 or newer
  - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs
  - SFTP: No longer has a packet limit when reading a directory
  - SFTP: now parses attribute extensions if they exist
  - SFTP: no longer will busy loop if SFTP fails to initialize
  - SFTP: now clear various errors as expected
  - SFTP: no longer skips files if the line buffer is too small
  - SCP: add option to not quote paths
  - SCP: Enables 64-bit offset support unconditionally
  - Now skips leading \r and \n characters in banner_receive()
  - Enables secure memory zeroing with all build tools on all platforms
  - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive
  - Speed up base64 encoding by 7x
  - Assert if there is an attempt to write a value that is too large
  - WinCNG: fix memory leak in _libssh2_dh_secret()
  - Added protection against possible null pointer dereferences
  - Agent now handles overly large comment lengths
  - Now ensure KEX replies don't include extra bytes
  - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER
  - Fixed possible buffer overflow in keyboard interactive code path
  - Fixed overlapping memcpy()
  - Fixed Windows UWP builds
  - Fixed DLL import name
  - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows
  - Support for building with gcc versions older than 8
  - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files
  - Restores ANSI C89 compliance
  - Enabled new compiler warnings and fixed/silenced them
  - Improved error messages
  - Now uses CIFuzz
  - Numerous minor code improvements
  - Improvements to CI builds
  - Improvements to unit tests
  - Improvements to doc files
  - Improvements to example files
  - Removed "old gex" build option
  - Removed no-encryption/no-mac builds
  - Removed support for NetWare and Watcom wmake build files
  * Rebase libssh2-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1693224000">- Security fix: [bsc#1214527, CVE-2020-22218]
  * The function _libssh2_packet_add() allows to access out of
    bounds memory.
  * Add libssh2_org-CVE-2020-22218.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1695038400">- Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040]
  * Add the keyring file: libssh2_org.keyring
  * Rebase libssh2-ocloexec.patch
  * Remove libssh2_org-CVE-2020-22218.patch</changelog>
</package>
<package pkgid="981d9b751518735b9128b870fb6af52aa03cca1da19c5455bc074444bedab6a9" name="libssh2_org" arch="src">
  <version epoch="0" ver="1.11.0" rel="150000.4.19.1"/>
  <changelog author="vcizek@suse.com" date="1357646400">- update to 1.4.3
    compression: add support for zlib@openssh.com
    Bug fixes:
    sftp_read: return error if a too large package arrives
    libssh2_hostkey_hash.3: update the description of return value
    examples: use stderr for messages, stdout for data
    openssl: do not leak memory when handling errors
    improved handling of disabled MD5 algorithm in OpenSSL
    known_hosts: Fail when parsing unknown keys in known_hosts file
    configure: gcrypt doesn't come with pkg-config support
    session_free: wrong variable used for keeping state
    libssh2_userauth_publickey_fromfile_ex.3: mention publickey == NULL
    comp_method_zlib_decomp: handle Z_BUF_ERROR when inflating
    Return LIBSSH2_ERROR_SOCKET_DISCONNECT on EOF when reading banner
    userauth.c: fread() from public key file to correctly detect any errors
    configure.ac: Add option to disable build of the example applications
    Added 'Requires.private:' line to libssh2.pc
    SFTP: filter off incoming "zombie" responses
    gettimeofday: no need for a replacement under cygwin
    SSH_MSG_CHANNEL_REQUEST: default to want_reply
    win32/libssh2_config.h: Remove hardcoded #define LIBSSH2_HAVE_ZLIB
    build error with gcrypt backend
    always do "forced" window updates to avoid corner case stalls
    aes: the init function fails when OpenSSL has AES support
    transport_send: Finish in-progress key exchange before sending data
    channel_write: acknowledge transport errors
    examples/x11.c: Make sure sizeof passed to read operation is correct
    examples/x11.c:,Fix suspicious sizeof usage
    sftp_packet_add: verify the packet before accepting it
    SFTP: preserve the original error code more
    sftp_packet_read: adjust window size as necessary
    Use safer snprintf rather then sprintf in several places
    Define and use LIBSSH2_INVALID_SOCKET instead of INVALID_SOCKET
    sftp_write: cannot return acked data *and* EAGAIN
    sftp_read: avoid data *and* EAGAIN
    libssh2.h: Add missing prototype for libssh2_session_banner_set()
- dropped patches (already in the upstream)
  0004-libssh2.h-Add-missing-prototype-for-libssh2_session_.patch
  0005-Add-symbol-versioning.patch
  0006-missing-libssh2_session_banner_set.patch</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1362052800">- Use AC_CONFIG_HEADERS instead of AM_CONFIG_HEADER, fixes
  build with new automake</changelog>
  <changelog author="boris@steki.net" date="1366804800">- fix building on older kernels and older OS / SLE</changelog>
  <changelog author="mvyskocil@suse.com" date="1372075200">- ignore groff-full to remove factory build cycle
- add groff to build requires to make tests passing</changelog>
  <changelog author="vcizek@suse.com" date="1426075200">- update to 1.5.0
  * fixes CVE-2015-1782 (bnc#921070)
- tarball verification
  * added libssh2_org.keyring
  * added libssh2-1.5.0.tar.gz.asc
  Changes in 1.5.0:
  Added Windows Cryptography API: Next Generation based backend
  Bug fixes:
  Security Advisory: Using `SSH_MSG_KEXINIT` data unbounded, CVE-2015-1782
  missing _libssh2_error in _libssh2_channel_write
  knownhost: Fix DSS keys being detected as unknown.
  knownhost: Restore behaviour of `libssh2_knownhost_writeline` with short buffer.
  libssh2.h: on Windows, a socket is of type SOCKET, not int
  libssh2_priv.h: a 1 bit bit-field should be unsigned
  windows build: do not export externals from static library
  Fixed two potential use-after-frees of the payload buffer
  Fixed a few memory leaks in error paths
  userauth: Fixed an attempt to free from stack on error
  agent_list_identities: Fixed memory leak on OOM
  knownhosts: Abort if the hosts buffer is too small
  sftp_close_handle: ensure the handle is always closed
  channel_close: Close the channel even in the case of errors
  docs: added missing libssh2_session_handshake.3 file
  docs: fixed a bunch of typos
  userauth_password: pass on the underlying error code
  _libssh2_channel_forward_cancel: accessed struct after free
  _libssh2_packet_add: avoid using uninitialized memory
  _libssh2_channel_forward_cancel: avoid memory leaks on error
  _libssh2_channel_write: client spins on write when window full
  windows build: fix build errors
  publickey_packet_receive: avoid junk in returned pointers
  channel_receive_window_adjust: store windows size always
  userauth_hostbased_fromfile: zero assign to avoid uninitialized use
  configure: change LIBS not LDFLAGS when checking for libs
  agent_connect_unix: make sure there's a trailing zero
  MinGW build: Fixed redefine warnings.
  sftpdir.c: added authentication method detection.
  Watcom build: added support for WinCNG build.
  configure.ac: replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS
  sftp_statvfs: fix for servers not supporting statfvs extension
  knownhost.c: use LIBSSH2_FREE macro instead of free
  Fixed compilation using mingw-w64
  knownhost.c: fixed that 'key_type_len' may be used uninitialized
  configure: Display individual crypto backends on separate lines
  examples on Windows: check for WSAStartup return code
  examples on Windows: check for socket return code
  agent.c: check return code of MapViewOfFile
  kex.c: fix possible NULL pointer de-reference with session-&gt;kex
  packet.c: fix possible NULL pointer de-reference within listen_state
  tests on Windows: check for WSAStartup return code
  userauth.c: improve readability and clarity of for-loops
  examples on Windows: use native SOCKET-type instead of int
  packet.c: i &lt; 256 was always true and i would overflow to 0
  kex.c: make sure mlist is not set to NULL
  session.c: check return value of session_nonblock in debug mode
  session.c: check return value of session_nonblock during startup
  userauth.c: make sure that sp_len is positive and avoid overflows
  knownhost.c: fix use of uninitialized argument variable wrote
  openssl: initialise the digest context before calling EVP_DigestInit()
  libssh2_agent_init: init -&gt;fd to LIBSSH2_INVALID_SOCKET
  configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib
  configure.ac: Rework crypto library detection
  configure.ac: Reorder --with-* options in --help output
  configure.ac: Call zlib zlib and not libz in text but keep option names
  Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro
  sftp: seek: Don't flush buffers on same offset
  sftp: statvfs: Along error path, reset the correct 'state' variable.
  sftp: Add support for fsync (OpenSSH extension).
  _libssh2_channel_read: fix data drop when out of window
  comp_method_zlib_decomp: Improve buffer growing algorithm
  _libssh2_channel_read: Honour window_size_initial
  window_size: redid window handling for flow control reasons
  knownhosts: handle unknown key types</changelog>
  <changelog author="vcizek@suse.com" date="1434110400">- update to 1.6.0
  Changes:
    Added CMake build system
    Added libssh2_userauth_publickey_frommemory()
  Bug fixes:
    wait_socket: wrong use of difftime()
    userauth: Fixed prompt text no longer being copied to the prompts struct
    mingw build: allow to pass custom CFLAGS
    Let mansyntax.sh work regardless of where it is called from
    Init HMAC_CTX before using it
    direct_tcpip: Fixed channel write
    WinCNG: fixed backend breakage
    OpenSSL: caused by introducing libssh2_hmac_ctx_init
    userauth.c: fix possible dereferences of a null pointer
    wincng: Added explicit clear memory feature to WinCNG backend
    openssl.c: fix possible segfault in case EVP_DigestInit fails
    wincng: fix return code of libssh2_md5_init()
    kex: do not ignore failure of libssh2_sha1_init()
    scp: fix that scp_send may transmit not initialised memory
    scp.c: improved command length calculation
    nonblocking examples: fix warning about unused tvdiff on Mac OS X
    configure: make clear-memory default but WARN if backend unsupported
    OpenSSL: Enable use of OpenSSL that doesn't have DSA
    OpenSSL: Use correct no-blowfish #define
    kex: fix libgcrypt memory leaks of bignum
    libssh2_channel_open: more detailed error message
    wincng: fixed memleak in (block) cipher destructor</changelog>
  <changelog author="vcizek@suse.com" date="1456228800">- update to 1.7.0
  * Fixes CVE-2016-0787 (boo#967026)
  * Changes:
    libssh2_session_set_last_error: Add function
    mac: Add support for HMAC-SHA-256 and HMAC-SHA-512
    WinCNG: support for SHA256/512 HMAC
    kex: Added diffie-hellman-group-exchange-sha256 support
    OS/400 crypto library QC3 support
  * and many bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497441600">- Version update to 1.8.0:
  * support openssl-1.1
  * many bugfixes
- Fixes bsc#1042660
- Remove obsolete conditionals that are no longer needed</changelog>
  <changelog author="jengelh@inai.de" date="1498737600">- Remove --with-pic which is only for static libs</changelog>
  <changelog author="dimstar@opensuse.org" date="1516104000">- Drop openssh BuildRequires: this is only used for one of the
  minor self-tests.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1552305600">- Security fixes:
  * [bsc#1128471, CVE-2019-3855] Possible integer overflow in transport
    read allows out-of-bounds write with specially crafted payload
  - libssh2_org-CVE-2019-3855.patch
  * [bsc#1128472, CVE-2019-3856] Possible integer overflow in keyboard
    interactive handling allows out-of-bounds write with specially
    crafted payload
  - libssh2_org-CVE-2019-3856.patch
  * [bsc#1128474, CVE-2019-3857] Possible integer overflow leading to
    zero-byte allocation and out-of-bounds with specially crafted
    message channel request SSH packet
  - libssh2_org-CVE-2019-3857.patch
  * [bsc#1128476, CVE-2019-3858] Possible zero-byte allocation leading
    to an out-of-bounds read with a specially crafted SFTP packet
  - libssh2_org-CVE-2019-3858.patch
  * [bsc#1128480, CVE-2019-3859] Out-of-bounds reads with specially
    crafted payloads due to unchecked use of _libssh2_packet_require
    and _libssh2_packet_requirev
  - libssh2_org-CVE-2019-3859.patch
  * [bsc#1128481, CVE-2019-3860] Out-of-bounds reads with specially
    crafted SFTP packets
  - libssh2_org-CVE-2019-3860.patch
  * [bsc#1128490, CVE-2019-3861] Out-of-bounds reads with specially
    crafted SSH packets
  - libssh2_org-CVE-2019-3861.patch
  * [bsc#1128492, CVE-2019-3862] Out-of-bounds memory comparison with
    specially crafted message channel request SSH packet
  - libssh2_org-CVE-2019-3862.patch
  * [bsc#1128493, CVE-2019-3863] Integer overflow in user authenicate
    keyboard interactive allows out-of-bounds writes with specially
    crafted keyboard responses
  - libssh2_org-CVE-2019-3863.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1554811200">- Version update to 1.8.2: [bsc#1130103]
  Bug fixes:
  * Fixed the misapplied userauth patch that broke 1.8.1
  * moved the MAX size declarations from the public header</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1556280000">- Fix upstream patch for CVE-2019-3859 [bsc#1133528, bsc#1130103]
  - Added libssh2_org-CVE-2019-3859-fix.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1571832000">- Security fix: [bsc#1154862, CVE-2019-17498]
  * The SSH_MSG_DISCONNECT:packet.c logic has an integer overflow in
    a bounds check that might lead to disclose sensitive information
    or cause a denial of service
  * Add patch libssh2_org-CVE-2019-17498.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1598529600">- Drop man and groff BuildRequires: both are no longer used in
  current versions.</changelog>
  <changelog author="pmonreal@suse.com" date="1603713600">- Version update to 1.9.0: [bsc#1178083, jsc#SLE-16922]
  Enhancements and bugfixes:
  * adds ECDSA keys and host key support when using OpenSSL
  * adds ED25519 key and host key support when using OpenSSL 1.1.1
  * adds OpenSSH style key file reading
  * adds AES CTR mode support when using WinCNG
  * adds PEM passphrase protected file support for Libgcrypt and WinCNG
  * adds SHA256 hostkey fingerprint
  * adds libssh2_agent_get_identity_path() and libssh2_agent_set_identity_path()
  * adds explicit zeroing of sensitive data in memory
  * adds additional bounds checks to network buffer reads
  * adds the ability to use the server default permissions when creating sftp directories
  * adds support for building with OpenSSL no engine flag
  * adds support for building with LibreSSL
  * increased sftp packet size to 256k
  * fixed oversized packet handling in sftp
  * fixed building with OpenSSL 1.1
  * fixed a possible crash if sftp stat gets an unexpected response
  * fixed incorrect parsing of the KEX preference string value
  * fixed conditional RSA and AES-CTR support
  * fixed a small memory leak during the key exchange process
  * fixed a possible memory leak of the ssh banner string
  * fixed various small memory leaks in the backends
  * fixed possible out of bounds read when parsing public keys from the server
  * fixed possible out of bounds read when parsing invalid PEM files
  * no longer null terminates the scp remote exec command
  * now handle errors when diffie hellman key pair generation fails
  * improved building instructions
  * improved unit tests
- Rebased patches:
  * libssh2-ocloexec.patch
  * libssh2_org-CVE-2019-17498.patch
- Remove patches fixed in this version:
  libssh2_org-CVE-2019-3855.patch libssh2_org-CVE-2019-3856.patch
  libssh2_org-CVE-2019-3857.patch libssh2_org-CVE-2019-3858.patch
  libssh2_org-CVE-2019-3859.patch libssh2_org-CVE-2019-3859-fix.patch
  libssh2_org-CVE-2019-3860.patch libssh2_org-CVE-2019-3861.patch
  libssh2_org-CVE-2019-3862.patch libssh2_org-CVE-2019-3863.patch</changelog>
  <changelog author="david.anes@suse.com" date="1639137600">- Bump to version 1.10.0
    Enhancements and bugfixes:
  * support ECDSA certificate authentication
  * fix detailed _libssh2_error being overwritten by generic errors
  * unified error handling
  * fix _libssh2_random() silently discarding errors
  * don't error if using keys without RSA
  * avoid OpenSSL latent error in FIPS mode
  * fix EVP_Cipher interface change in openssl 3
  * fix potential overwrite of buffer when reading stdout of command
  * use string_buf in ecdh_sha2_nistp() to avoid attempting to parse malformed data
  * correct a typo which may lead to stack overflow
  * fix random big number generation to match openssl
  * added key exchange group16-sha512 and group18-sha512.
  * add support for an OSS Fuzzer fuzzing target
  * adds support for ECDSA for both key exchange and host key algorithms
  * clean up curve25519 code
  * update the min, preferred and max DH group values based on RFC 8270.
  * changed type of LIBSSH2_FX_* constants to unsigned long
  * added diffie-hellman-group14-sha256 kex
  * fix for use of uninitialized aes_ctr_cipher.key_len when using HAVE_OPAQUE_STRUCTS, regression
  * fixes memory leaks and use after free AES EVP_CIPHER contexts when using OpenSSL 1.0.x.
  * fixes crash with delayed compression option using Bitvise server.
  * adds support for PKIX key reading
  * use new API to parse data in packet_x11_open() for better bounds checking.
  * double the static buffer size when reading and writing known hosts
  * improved bounds checking in packet_queue_listener
  * improve message parsing (CVE-2019-17498)
  * improve bounds checking in kex_agree_methods()
  * adding SSH agent forwarding.
  * fix agent forwarding message, updated example.
  * added integration test code and cmake target. Added example to cmake list.
  * don't call `libssh2_crypto_exit()` until `_libssh2_initialized` count is down to zero.
  * add an EWOULDBLOCK check for better portability
  * fix off by one error when loading public keys with no id
  * fix use-after-free crash on reinitialization of openssl backend
  * preserve error info from agent_list_identities()
  * make sure the error code is set in _libssh2_channel_open()
  * fixed misspellings
  * fix potential typecast error for `_libssh2_ecdsa_key_get_curve_type`
  * rename _libssh2_ecdsa_key_get_curve_type to _libssh2_ecdsa_get_curve_type
- Rebased patch libssh2-ocloexec.path
- Removed patch libssh2_org-CVE-2019-17498.patch: the security fix
    is already included in the latest version.</changelog>
  <changelog author="pmonreal@suse.com" date="1687262400">- Update to 1.11.0:
  * Enhancements and bugfixes
  - Adds support for encrypt-then-mac (ETM) MACs
  - Adds support for AES-GCM crypto protocols
  - Adds support for sk-ecdsa-sha2-nistp256 and sk-ssh-ed25519 keys
  - Adds support for RSA certificate authentication
  - Adds FIDO support with *_sk() functions
  - Adds RSA-SHA2 key upgrading to OpenSSL, WinCNG, mbedTLS, OS400 backends
  - Adds Agent Forwarding and libssh2_agent_sign()
  - Adds support for Channel Signal message libssh2_channel_signal_ex()
  - Adds support to get the user auth banner message libssh2_userauth_banner()
  - Adds LIBSSH2_NO_{MD5, HMAC_RIPEMD, DSA, RSA, RSA_SHA1, ECDSA, ED25519,
    AES_CBC, AES_CTR, BLOWFISH, RC4, CAST, 3DES} options
  - Adds direct stream UNIX sockets with libssh2_channel_direct_streamlocal_ex()
  - Adds wolfSSL support to CMake file
  - Adds mbedTLS 3.x support
  - Adds LibreSSL 3.5 support
  - Adds support for CMake "unity" builds
  - Adds CMake support for building shared and static libs in a single pass
  - Adds symbol hiding support to CMake
  - Adds support for libssh2.rc for all build tools
  - Adds .zip, .tar.xz and .tar.bz2 release tarballs
  - Enables ed25519 key support for LibreSSL 3.7.0 or higher
  - Improves OpenSSL 1.1 and 3 compatibility
  - Now requires OpenSSL 1.0.2 or newer
  - Now requires CMake 3.1 or newer
  - SFTP: Adds libssh2_sftp_open_ex_r() and libssh2_sftp_open_r() extended APIs
  - SFTP: No longer has a packet limit when reading a directory
  - SFTP: now parses attribute extensions if they exist
  - SFTP: no longer will busy loop if SFTP fails to initialize
  - SFTP: now clear various errors as expected
  - SFTP: no longer skips files if the line buffer is too small
  - SCP: add option to not quote paths
  - SCP: Enables 64-bit offset support unconditionally
  - Now skips leading \r and \n characters in banner_receive()
  - Enables secure memory zeroing with all build tools on all platforms
  - No longer logs SSH_MSG_REQUEST_FAILURE packets from keepalive
  - Speed up base64 encoding by 7x
  - Assert if there is an attempt to write a value that is too large
  - WinCNG: fix memory leak in _libssh2_dh_secret()
  - Added protection against possible null pointer dereferences
  - Agent now handles overly large comment lengths
  - Now ensure KEX replies don't include extra bytes
  - Fixed possible buffer overflow when receiving SSH_MSG_USERAUTH_BANNER
  - Fixed possible buffer overflow in keyboard interactive code path
  - Fixed overlapping memcpy()
  - Fixed Windows UWP builds
  - Fixed DLL import name
  - Renamed local RANDOM_PADDING macro to avoid unexpected define on Windows
  - Support for building with gcc versions older than 8
  - Improvements to CMake, Makefile, NMakefile, GNUmakefile, autoreconf files
  - Restores ANSI C89 compliance
  - Enabled new compiler warnings and fixed/silenced them
  - Improved error messages
  - Now uses CIFuzz
  - Numerous minor code improvements
  - Improvements to CI builds
  - Improvements to unit tests
  - Improvements to doc files
  - Improvements to example files
  - Removed "old gex" build option
  - Removed no-encryption/no-mac builds
  - Removed support for NetWare and Watcom wmake build files
  * Rebase libssh2-ocloexec.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1693224000">- Security fix: [bsc#1214527, CVE-2020-22218]
  * The function _libssh2_packet_add() allows to access out of
    bounds memory.
  * Add libssh2_org-CVE-2020-22218.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1695038400">- Upgrade to version 1.11.0 in SLE-15: [jsc#PED-7040]
  * Add the keyring file: libssh2_org.keyring
  * Rebase libssh2-ocloexec.patch
  * Remove libssh2_org-CVE-2020-22218.patch</changelog>
</package>
<package pkgid="efe936ffc7cce4db20d76cc008f49305b39da45720b82285487eceb31efc2f64" name="libsss_certmap0" arch="aarch64">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="9796a1e88a9bd72d9c304ced8a7ea7f749e8868dabc3855340e2b07bcb36bfaf" name="libsss_certmap0" arch="s390x">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="47cac0ceda4abc2b269e96a93102c75bc74f6bcfa58b3ab72e1db672f40bed06" name="libsss_certmap0" arch="x86_64">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="0a353683f4b68c8702f9895bfb16b4b2e0c393095e27f7df7a3fdd8560f6869e" name="libsss_idmap0" arch="aarch64">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="455883246011a199f9a6f80b1a44ac3e9fbeeb097f4289e1e7f0bda413d64e04" name="libsss_idmap0" arch="s390x">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="9e69c6f7a0cf10a9fd23f46c7a019c79824340fbefd03461a4f8e569d78eeaf5" name="libsss_idmap0" arch="x86_64">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="721a4fac7c586f4a248a1c8cb5cb90ba47620cdbbae7eecb94e217301bcf1696" name="libsss_nss_idmap0" arch="aarch64">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="9173f1c32ebc67b6df78454779be2a8b47c1cae69774db8b322c96d085e28994" name="libsss_nss_idmap0" arch="s390x">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="910b8a5db27dc7391f970061dee675f810661de7c1f399ac02bcf7af01959603" name="libsss_nss_idmap0" arch="x86_64">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="bef4355b201cfb6ce68d32843281bde86a0d1a09346eaf3a89a786e7d2acab98" name="libstdc++6" arch="aarch64">
  <version epoch="0" ver="13.2.1+git7813" rel="150000.1.3.3"/>
  <changelog author="mliska@suse.cz" date="1679659200">- Use --enable-link-serialization rather that --enable-link-mutex,
  the benefit of the former one is that the linker jobs are not
  holding tokens of the make's jobserver.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1679659201">- Add %limit_build for gcc13 to avoid OOM</changelog>
  <changelog author="mliska@suse.cz" date="1680609600">- Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995.</changelog>
  <changelog author="schwab@suse.de" date="1681214400">- riscv-atomic.patch: RISC-V: Add support for inlining subword atomic
  operations
- riscv-pthread.patch: Don't add -latomic with -pthread</changelog>
  <changelog author="mliska@suse.cz" date="1681214401">- Add new x86-related intrinsics (amxcomplexintrin.h).</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162.</changelog>
  <changelog author="rguenther@suse.com" date="1682078400">- Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231.
  * fixes compile-time issue reported in [bsc#1210557]
  * GCC 13.1 RC3
- Disable building the rust frontend.</changelog>
  <changelog author="rguenther@suse.com" date="1682596800">- Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256.
  * Includes GCC 13.1 release and first bugfixes
- Update riscv-atomic.patch from the version committed upstream.</changelog>
  <changelog author="rguenther@suse.com" date="1684756800">- Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364.
  * Includes the RISC-V atomic changes
- Remove riscv-atomic.patch and riscv-pthread.patch now included
- Make libstdc++6-devel packages own their directories since they
  can be installed standalone.  [bsc#1211427]</changelog>
  <changelog author="rguenther@suse.com" date="1686657600">- Raise architecture levels for ALP.  [PED-153]
  * Raise POWER architecture baseline to power9.  [PED-2005]
  * Raise x86-64 architecture baseline to x86-64-v2 for ALP.  [PED-252]
  * Delay raising s390x architecture baseline to z14.  [PED-253]</changelog>
  <changelog author="rguenther@suse.com" date="1687953600">- Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489.
- Add gcc13-pr110334.patch to fix missed optimization in Skia
  resulting in Firefox crashes when building with LTO.  [boo#1212101]</changelog>
  <changelog author="rguenther@suse.com" date="1688990400">- Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552
- Remove gcc13-pr110334.patch again as it breaks libreoffice build.</changelog>
  <changelog author="schwab@suse.de" date="1689076800">- Also handle -static-pie in the default-PIE specs</changelog>
  <changelog author="rguenther@suse.com" date="1689854400">- Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597
  * GCC 13.2 RC1
- Add rpmlint filter for SLE12 complaining about invalid licenses.</changelog>
  <changelog author="schwab@suse.de" date="1690977600">- gdcflags.patch: Use substituted GDCFLAGS
- Filter out -Werror=return-type from D compile flags</changelog>
  <changelog author="rguenther@suse.com" date="1691064000">- Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683
  * Includes GCC 13.2 release
  * Includes patch to fix broken testcase in libbacktrace, fixing
    build problems on SLES 12</changelog>
  <changelog author="msuchanek@suse.com" date="1692360000">- Raise Power architecture baseline to Power9 only for ALP (boo#1213915).</changelog>
  <changelog author="rguenther@suse.com" date="1692792000">- Turn cross compiler to s390x to a glibc cross.  [bsc#1214460]</changelog>
  <changelog author="rguenther@suse.com" date="1693224000">- Disable building glibc cross compilers on SLE based code streams,
  the required cross-glibc packages are not available there.
- Disable building avr cross on non-openSUSE code streams since
  avr-libc isn't available there.
- Disable building newlib cross compilers on non-openSUSE code streams
  since newlib isn't available there.
- Fix typo preventing s390x compiler build.
- Raise s390x architecture baseline to z14 for ALP.  [PED-253]
- Turn cross compiler to ppc64le to a glibc cross.</changelog>
  <changelog author="rguenther@suse.com" date="1694520000">- Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831
  * Includes many bugfixes
  * Includes fix to -fstack-protector issues with variable
    length stack allocations on aarch64.  [bsc#1214052] (CVE-2023-4039)</changelog>
</package>
<package pkgid="f41cae9fa57f23c34e4f653fe800fbce42ef8d51f9e75944d490677904ee00f2" name="libstdc++6" arch="s390x">
  <version epoch="0" ver="13.2.1+git7813" rel="150000.1.3.3"/>
  <changelog author="mliska@suse.cz" date="1679659200">- Use --enable-link-serialization rather that --enable-link-mutex,
  the benefit of the former one is that the linker jobs are not
  holding tokens of the make's jobserver.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1679659201">- Add %limit_build for gcc13 to avoid OOM</changelog>
  <changelog author="mliska@suse.cz" date="1680609600">- Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995.</changelog>
  <changelog author="schwab@suse.de" date="1681214400">- riscv-atomic.patch: RISC-V: Add support for inlining subword atomic
  operations
- riscv-pthread.patch: Don't add -latomic with -pthread</changelog>
  <changelog author="mliska@suse.cz" date="1681214401">- Add new x86-related intrinsics (amxcomplexintrin.h).</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162.</changelog>
  <changelog author="rguenther@suse.com" date="1682078400">- Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231.
  * fixes compile-time issue reported in [bsc#1210557]
  * GCC 13.1 RC3
- Disable building the rust frontend.</changelog>
  <changelog author="rguenther@suse.com" date="1682596800">- Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256.
  * Includes GCC 13.1 release and first bugfixes
- Update riscv-atomic.patch from the version committed upstream.</changelog>
  <changelog author="rguenther@suse.com" date="1684756800">- Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364.
  * Includes the RISC-V atomic changes
- Remove riscv-atomic.patch and riscv-pthread.patch now included
- Make libstdc++6-devel packages own their directories since they
  can be installed standalone.  [bsc#1211427]</changelog>
  <changelog author="rguenther@suse.com" date="1686657600">- Raise architecture levels for ALP.  [PED-153]
  * Raise POWER architecture baseline to power9.  [PED-2005]
  * Raise x86-64 architecture baseline to x86-64-v2 for ALP.  [PED-252]
  * Delay raising s390x architecture baseline to z14.  [PED-253]</changelog>
  <changelog author="rguenther@suse.com" date="1687953600">- Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489.
- Add gcc13-pr110334.patch to fix missed optimization in Skia
  resulting in Firefox crashes when building with LTO.  [boo#1212101]</changelog>
  <changelog author="rguenther@suse.com" date="1688990400">- Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552
- Remove gcc13-pr110334.patch again as it breaks libreoffice build.</changelog>
  <changelog author="schwab@suse.de" date="1689076800">- Also handle -static-pie in the default-PIE specs</changelog>
  <changelog author="rguenther@suse.com" date="1689854400">- Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597
  * GCC 13.2 RC1
- Add rpmlint filter for SLE12 complaining about invalid licenses.</changelog>
  <changelog author="schwab@suse.de" date="1690977600">- gdcflags.patch: Use substituted GDCFLAGS
- Filter out -Werror=return-type from D compile flags</changelog>
  <changelog author="rguenther@suse.com" date="1691064000">- Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683
  * Includes GCC 13.2 release
  * Includes patch to fix broken testcase in libbacktrace, fixing
    build problems on SLES 12</changelog>
  <changelog author="msuchanek@suse.com" date="1692360000">- Raise Power architecture baseline to Power9 only for ALP (boo#1213915).</changelog>
  <changelog author="rguenther@suse.com" date="1692792000">- Turn cross compiler to s390x to a glibc cross.  [bsc#1214460]</changelog>
  <changelog author="rguenther@suse.com" date="1693224000">- Disable building glibc cross compilers on SLE based code streams,
  the required cross-glibc packages are not available there.
- Disable building avr cross on non-openSUSE code streams since
  avr-libc isn't available there.
- Disable building newlib cross compilers on non-openSUSE code streams
  since newlib isn't available there.
- Fix typo preventing s390x compiler build.
- Raise s390x architecture baseline to z14 for ALP.  [PED-253]
- Turn cross compiler to ppc64le to a glibc cross.</changelog>
  <changelog author="rguenther@suse.com" date="1694520000">- Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831
  * Includes many bugfixes
  * Includes fix to -fstack-protector issues with variable
    length stack allocations on aarch64.  [bsc#1214052] (CVE-2023-4039)</changelog>
</package>
<package pkgid="7590b7360d613712900026e0240e94952e484e7af6d76dd3239a935176911f9e" name="libstdc++6" arch="x86_64">
  <version epoch="0" ver="13.2.1+git7813" rel="150000.1.3.3"/>
  <changelog author="mliska@suse.cz" date="1679659200">- Use --enable-link-serialization rather that --enable-link-mutex,
  the benefit of the former one is that the linker jobs are not
  holding tokens of the make's jobserver.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1679659201">- Add %limit_build for gcc13 to avoid OOM</changelog>
  <changelog author="mliska@suse.cz" date="1680609600">- Bump to d0b961b802dd7d9d555ff4515835a479329326e9, git6995.</changelog>
  <changelog author="schwab@suse.de" date="1681214400">- riscv-atomic.patch: RISC-V: Add support for inlining subword atomic
  operations
- riscv-pthread.patch: Don't add -latomic with -pthread</changelog>
  <changelog author="mliska@suse.cz" date="1681214401">- Add new x86-related intrinsics (amxcomplexintrin.h).</changelog>
  <changelog author="mliska@suse.cz" date="1681300800">- Bump to d339e9802f758e051b0a1ef6db732ff846cbf4e3, git7162.</changelog>
  <changelog author="rguenther@suse.com" date="1682078400">- Bump to f980561c60b0446cc427595198d7f3f4f90e0924, git7231.
  * fixes compile-time issue reported in [bsc#1210557]
  * GCC 13.1 RC3
- Disable building the rust frontend.</changelog>
  <changelog author="rguenther@suse.com" date="1682596800">- Bump to 910735c5d7ce7607384fc1eec4189e90c8ae5c84, git7256.
  * Includes GCC 13.1 release and first bugfixes
- Update riscv-atomic.patch from the version committed upstream.</changelog>
  <changelog author="rguenther@suse.com" date="1684756800">- Bump to dd36656ada05731c069ecd5b1878380294fb1f3e, git7364.
  * Includes the RISC-V atomic changes
- Remove riscv-atomic.patch and riscv-pthread.patch now included
- Make libstdc++6-devel packages own their directories since they
  can be installed standalone.  [bsc#1211427]</changelog>
  <changelog author="rguenther@suse.com" date="1686657600">- Raise architecture levels for ALP.  [PED-153]
  * Raise POWER architecture baseline to power9.  [PED-2005]
  * Raise x86-64 architecture baseline to x86-64-v2 for ALP.  [PED-252]
  * Delay raising s390x architecture baseline to z14.  [PED-253]</changelog>
  <changelog author="rguenther@suse.com" date="1687953600">- Bump to a533ded17fb13cbbb2fa5133ecd470360f66c5cf, git7489.
- Add gcc13-pr110334.patch to fix missed optimization in Skia
  resulting in Firefox crashes when building with LTO.  [boo#1212101]</changelog>
  <changelog author="rguenther@suse.com" date="1688990400">- Bump to f9781fcf733ca3afe5b5811afd8ecbb18d9d3a11, git7552
- Remove gcc13-pr110334.patch again as it breaks libreoffice build.</changelog>
  <changelog author="schwab@suse.de" date="1689076800">- Also handle -static-pie in the default-PIE specs</changelog>
  <changelog author="rguenther@suse.com" date="1689854400">- Bump to 9aac37ab8a7b919a89c6d64bc7107a8436996e93, git7597
  * GCC 13.2 RC1
- Add rpmlint filter for SLE12 complaining about invalid licenses.</changelog>
  <changelog author="schwab@suse.de" date="1690977600">- gdcflags.patch: Use substituted GDCFLAGS
- Filter out -Werror=return-type from D compile flags</changelog>
  <changelog author="rguenther@suse.com" date="1691064000">- Bump to cc279d6c64562f05019e1d12d0d825f9391b5553, git7683
  * Includes GCC 13.2 release
  * Includes patch to fix broken testcase in libbacktrace, fixing
    build problems on SLES 12</changelog>
  <changelog author="msuchanek@suse.com" date="1692360000">- Raise Power architecture baseline to Power9 only for ALP (boo#1213915).</changelog>
  <changelog author="rguenther@suse.com" date="1692792000">- Turn cross compiler to s390x to a glibc cross.  [bsc#1214460]</changelog>
  <changelog author="rguenther@suse.com" date="1693224000">- Disable building glibc cross compilers on SLE based code streams,
  the required cross-glibc packages are not available there.
- Disable building avr cross on non-openSUSE code streams since
  avr-libc isn't available there.
- Disable building newlib cross compilers on non-openSUSE code streams
  since newlib isn't available there.
- Fix typo preventing s390x compiler build.
- Raise s390x architecture baseline to z14 for ALP.  [PED-253]
- Turn cross compiler to ppc64le to a glibc cross.</changelog>
  <changelog author="rguenther@suse.com" date="1694520000">- Bump to b96e66fd4ef3e36983969fb8cdd1956f551a074b, git7831
  * Includes many bugfixes
  * Includes fix to -fstack-protector issues with variable
    length stack allocations on aarch64.  [bsc#1214052] (CVE-2023-4039)</changelog>
</package>
<package pkgid="eb5b5a502916bf9031f59defc16768a3bf73dc59d347cbc48efc4778d2bd21d1" name="libsystemd0" arch="aarch64">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="0722bbd672b17ad3e69cb21fb1e3bd3db3f333afddc96b4430cd3b1af312ae49" name="libsystemd0" arch="s390x">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="a4edda3110a9a6a68697333345fab4d4590ee56aa28d8d14eb011e3253d30e62" name="libsystemd0" arch="x86_64">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="c0f8341e8e6b626ec382448c5e0b80aaad89ea4b0dd501b319a78606a647eead" name="libtirpc" arch="src">
  <version epoch="0" ver="1.3.4" rel="150300.3.20.1"/>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1669723200">- consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding
  to a random port (bsc#1199467)
  - add binddynport-honor-ip_local_reserved_ports.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1697198400">-  update to 1.3.4 (bsc#1199467)
  * binddynport.c honor ip_local_reserved_ports
  - replaces: binddynport-honor-ip_local_reserved_ports.patch
  * gss-api: expose gss major/minor error in authgss_refresh()
  * rpcb_clnt.c: Eliminate double frees in delete_cache()
  * rpcb_clnt.c: memory leak in destroy_addr
  * portmapper: allow TCP-only portmapper
  * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep
  * clnt_raw.c: fix a possible null pointer dereference
  * bindresvport.c: fix a potential resource leakage
- update to 1.3.3 (bsc#1201680, CVE-2021-46828):
  * Fix DoS vulnerability in libtirpc
  - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch
  * _rpc_dtablesize: use portable system call
  * libtirpc: Fix use-after-free accessing the error number
  * Fix potential memory leak of parms.r_addr
  - replaces 0001-fix-parms.r_addr-memory-leak.patch
  * rpcb_clnt.c add mechanism to try v2 protocol first
  - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch
  * Eliminate deadlocks in connects with an MT environment
  * clnt_dg_freeres() uncleared set active state may deadlock
  * thread safe clnt destruction
  * SUNRPC: mutexed access blacklist_read state variable
  * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c
- drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream)
- update to 1.3.2:
  * Replace the final SunRPC licenses with BSD licenses
  * blacklist: Add a few more well known ports
  * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS
- Update to libtirpc 1.3.1
  * Remove AUTH_DES interfaces from auth_des.h
    The unsupported  AUTH_DES authentication has be
    compiled out since commit d918e41d889 (Wed Oct 9 2019)
    replaced by API routines that return errors.
  * svc_dg: Free xp_netid during destroy
  * Fix memory management issues of fd locks
  * libtirpc: replace array with list for per-fd locks
  * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf
  * __rpc_dtbsize: rlim_cur instead of rlim_max
  * pkg-config: use the correct replacements for libdir/includedir
  Patches replaced by update:
  binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467)
  0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680)
  0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752)
  0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch
  (bsc#1196647), (bsc#1200800), (bsc#1198176)
  * replaces /etc/netconfig-try-2-first by the environment variable
  RPCB_V2FIRST</changelog>
</package>
<package pkgid="84a52092f2f8ac159ec372cff55eeee3d0d04b38a55d1be2b7f235855952e81b" name="libtirpc-netconfig" arch="aarch64">
  <version epoch="0" ver="1.3.4" rel="150300.3.20.1"/>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1669723200">- consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding
  to a random port (bsc#1199467)
  - add binddynport-honor-ip_local_reserved_ports.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1697198400">-  update to 1.3.4 (bsc#1199467)
  * binddynport.c honor ip_local_reserved_ports
  - replaces: binddynport-honor-ip_local_reserved_ports.patch
  * gss-api: expose gss major/minor error in authgss_refresh()
  * rpcb_clnt.c: Eliminate double frees in delete_cache()
  * rpcb_clnt.c: memory leak in destroy_addr
  * portmapper: allow TCP-only portmapper
  * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep
  * clnt_raw.c: fix a possible null pointer dereference
  * bindresvport.c: fix a potential resource leakage
- update to 1.3.3 (bsc#1201680, CVE-2021-46828):
  * Fix DoS vulnerability in libtirpc
  - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch
  * _rpc_dtablesize: use portable system call
  * libtirpc: Fix use-after-free accessing the error number
  * Fix potential memory leak of parms.r_addr
  - replaces 0001-fix-parms.r_addr-memory-leak.patch
  * rpcb_clnt.c add mechanism to try v2 protocol first
  - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch
  * Eliminate deadlocks in connects with an MT environment
  * clnt_dg_freeres() uncleared set active state may deadlock
  * thread safe clnt destruction
  * SUNRPC: mutexed access blacklist_read state variable
  * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c
- drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream)
- update to 1.3.2:
  * Replace the final SunRPC licenses with BSD licenses
  * blacklist: Add a few more well known ports
  * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS
- Update to libtirpc 1.3.1
  * Remove AUTH_DES interfaces from auth_des.h
    The unsupported  AUTH_DES authentication has be
    compiled out since commit d918e41d889 (Wed Oct 9 2019)
    replaced by API routines that return errors.
  * svc_dg: Free xp_netid during destroy
  * Fix memory management issues of fd locks
  * libtirpc: replace array with list for per-fd locks
  * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf
  * __rpc_dtbsize: rlim_cur instead of rlim_max
  * pkg-config: use the correct replacements for libdir/includedir
  Patches replaced by update:
  binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467)
  0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680)
  0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752)
  0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch
  (bsc#1196647), (bsc#1200800), (bsc#1198176)
  * replaces /etc/netconfig-try-2-first by the environment variable
  RPCB_V2FIRST</changelog>
</package>
<package pkgid="a4a30e8e4394655710865b55f575d520e8689b2ac66038378d947c5faf1ec981" name="libtirpc-netconfig" arch="s390x">
  <version epoch="0" ver="1.3.4" rel="150300.3.20.1"/>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1669723200">- consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding
  to a random port (bsc#1199467)
  - add binddynport-honor-ip_local_reserved_ports.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1697198400">-  update to 1.3.4 (bsc#1199467)
  * binddynport.c honor ip_local_reserved_ports
  - replaces: binddynport-honor-ip_local_reserved_ports.patch
  * gss-api: expose gss major/minor error in authgss_refresh()
  * rpcb_clnt.c: Eliminate double frees in delete_cache()
  * rpcb_clnt.c: memory leak in destroy_addr
  * portmapper: allow TCP-only portmapper
  * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep
  * clnt_raw.c: fix a possible null pointer dereference
  * bindresvport.c: fix a potential resource leakage
- update to 1.3.3 (bsc#1201680, CVE-2021-46828):
  * Fix DoS vulnerability in libtirpc
  - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch
  * _rpc_dtablesize: use portable system call
  * libtirpc: Fix use-after-free accessing the error number
  * Fix potential memory leak of parms.r_addr
  - replaces 0001-fix-parms.r_addr-memory-leak.patch
  * rpcb_clnt.c add mechanism to try v2 protocol first
  - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch
  * Eliminate deadlocks in connects with an MT environment
  * clnt_dg_freeres() uncleared set active state may deadlock
  * thread safe clnt destruction
  * SUNRPC: mutexed access blacklist_read state variable
  * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c
- drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream)
- update to 1.3.2:
  * Replace the final SunRPC licenses with BSD licenses
  * blacklist: Add a few more well known ports
  * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS
- Update to libtirpc 1.3.1
  * Remove AUTH_DES interfaces from auth_des.h
    The unsupported  AUTH_DES authentication has be
    compiled out since commit d918e41d889 (Wed Oct 9 2019)
    replaced by API routines that return errors.
  * svc_dg: Free xp_netid during destroy
  * Fix memory management issues of fd locks
  * libtirpc: replace array with list for per-fd locks
  * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf
  * __rpc_dtbsize: rlim_cur instead of rlim_max
  * pkg-config: use the correct replacements for libdir/includedir
  Patches replaced by update:
  binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467)
  0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680)
  0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752)
  0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch
  (bsc#1196647), (bsc#1200800), (bsc#1198176)
  * replaces /etc/netconfig-try-2-first by the environment variable
  RPCB_V2FIRST</changelog>
</package>
<package pkgid="ad01059eba7c87d88d7bf2dc6a808337d690fe15d58d57c2ba10f70e1700f14e" name="libtirpc-netconfig" arch="x86_64">
  <version epoch="0" ver="1.3.4" rel="150300.3.20.1"/>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1669723200">- consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding
  to a random port (bsc#1199467)
  - add binddynport-honor-ip_local_reserved_ports.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1697198400">-  update to 1.3.4 (bsc#1199467)
  * binddynport.c honor ip_local_reserved_ports
  - replaces: binddynport-honor-ip_local_reserved_ports.patch
  * gss-api: expose gss major/minor error in authgss_refresh()
  * rpcb_clnt.c: Eliminate double frees in delete_cache()
  * rpcb_clnt.c: memory leak in destroy_addr
  * portmapper: allow TCP-only portmapper
  * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep
  * clnt_raw.c: fix a possible null pointer dereference
  * bindresvport.c: fix a potential resource leakage
- update to 1.3.3 (bsc#1201680, CVE-2021-46828):
  * Fix DoS vulnerability in libtirpc
  - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch
  * _rpc_dtablesize: use portable system call
  * libtirpc: Fix use-after-free accessing the error number
  * Fix potential memory leak of parms.r_addr
  - replaces 0001-fix-parms.r_addr-memory-leak.patch
  * rpcb_clnt.c add mechanism to try v2 protocol first
  - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch
  * Eliminate deadlocks in connects with an MT environment
  * clnt_dg_freeres() uncleared set active state may deadlock
  * thread safe clnt destruction
  * SUNRPC: mutexed access blacklist_read state variable
  * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c
- drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream)
- update to 1.3.2:
  * Replace the final SunRPC licenses with BSD licenses
  * blacklist: Add a few more well known ports
  * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS
- Update to libtirpc 1.3.1
  * Remove AUTH_DES interfaces from auth_des.h
    The unsupported  AUTH_DES authentication has be
    compiled out since commit d918e41d889 (Wed Oct 9 2019)
    replaced by API routines that return errors.
  * svc_dg: Free xp_netid during destroy
  * Fix memory management issues of fd locks
  * libtirpc: replace array with list for per-fd locks
  * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf
  * __rpc_dtbsize: rlim_cur instead of rlim_max
  * pkg-config: use the correct replacements for libdir/includedir
  Patches replaced by update:
  binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467)
  0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680)
  0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752)
  0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch
  (bsc#1196647), (bsc#1200800), (bsc#1198176)
  * replaces /etc/netconfig-try-2-first by the environment variable
  RPCB_V2FIRST</changelog>
</package>
<package pkgid="54298f3dd6e231045ef2b7bb0d16ba6fdc40815d6dd80aa3e3e94589ada7213c" name="libtirpc3" arch="aarch64">
  <version epoch="0" ver="1.3.4" rel="150300.3.20.1"/>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1669723200">- consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding
  to a random port (bsc#1199467)
  - add binddynport-honor-ip_local_reserved_ports.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1697198400">-  update to 1.3.4 (bsc#1199467)
  * binddynport.c honor ip_local_reserved_ports
  - replaces: binddynport-honor-ip_local_reserved_ports.patch
  * gss-api: expose gss major/minor error in authgss_refresh()
  * rpcb_clnt.c: Eliminate double frees in delete_cache()
  * rpcb_clnt.c: memory leak in destroy_addr
  * portmapper: allow TCP-only portmapper
  * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep
  * clnt_raw.c: fix a possible null pointer dereference
  * bindresvport.c: fix a potential resource leakage
- update to 1.3.3 (bsc#1201680, CVE-2021-46828):
  * Fix DoS vulnerability in libtirpc
  - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch
  * _rpc_dtablesize: use portable system call
  * libtirpc: Fix use-after-free accessing the error number
  * Fix potential memory leak of parms.r_addr
  - replaces 0001-fix-parms.r_addr-memory-leak.patch
  * rpcb_clnt.c add mechanism to try v2 protocol first
  - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch
  * Eliminate deadlocks in connects with an MT environment
  * clnt_dg_freeres() uncleared set active state may deadlock
  * thread safe clnt destruction
  * SUNRPC: mutexed access blacklist_read state variable
  * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c
- drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream)
- update to 1.3.2:
  * Replace the final SunRPC licenses with BSD licenses
  * blacklist: Add a few more well known ports
  * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS
- Update to libtirpc 1.3.1
  * Remove AUTH_DES interfaces from auth_des.h
    The unsupported  AUTH_DES authentication has be
    compiled out since commit d918e41d889 (Wed Oct 9 2019)
    replaced by API routines that return errors.
  * svc_dg: Free xp_netid during destroy
  * Fix memory management issues of fd locks
  * libtirpc: replace array with list for per-fd locks
  * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf
  * __rpc_dtbsize: rlim_cur instead of rlim_max
  * pkg-config: use the correct replacements for libdir/includedir
  Patches replaced by update:
  binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467)
  0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680)
  0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752)
  0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch
  (bsc#1196647), (bsc#1200800), (bsc#1198176)
  * replaces /etc/netconfig-try-2-first by the environment variable
  RPCB_V2FIRST</changelog>
</package>
<package pkgid="46817297bf97a346b5defa5438579b57e9a9d835dee62b7904ce04d534bd6fc3" name="libtirpc3" arch="s390x">
  <version epoch="0" ver="1.3.4" rel="150300.3.20.1"/>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1669723200">- consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding
  to a random port (bsc#1199467)
  - add binddynport-honor-ip_local_reserved_ports.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1697198400">-  update to 1.3.4 (bsc#1199467)
  * binddynport.c honor ip_local_reserved_ports
  - replaces: binddynport-honor-ip_local_reserved_ports.patch
  * gss-api: expose gss major/minor error in authgss_refresh()
  * rpcb_clnt.c: Eliminate double frees in delete_cache()
  * rpcb_clnt.c: memory leak in destroy_addr
  * portmapper: allow TCP-only portmapper
  * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep
  * clnt_raw.c: fix a possible null pointer dereference
  * bindresvport.c: fix a potential resource leakage
- update to 1.3.3 (bsc#1201680, CVE-2021-46828):
  * Fix DoS vulnerability in libtirpc
  - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch
  * _rpc_dtablesize: use portable system call
  * libtirpc: Fix use-after-free accessing the error number
  * Fix potential memory leak of parms.r_addr
  - replaces 0001-fix-parms.r_addr-memory-leak.patch
  * rpcb_clnt.c add mechanism to try v2 protocol first
  - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch
  * Eliminate deadlocks in connects with an MT environment
  * clnt_dg_freeres() uncleared set active state may deadlock
  * thread safe clnt destruction
  * SUNRPC: mutexed access blacklist_read state variable
  * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c
- drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream)
- update to 1.3.2:
  * Replace the final SunRPC licenses with BSD licenses
  * blacklist: Add a few more well known ports
  * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS
- Update to libtirpc 1.3.1
  * Remove AUTH_DES interfaces from auth_des.h
    The unsupported  AUTH_DES authentication has be
    compiled out since commit d918e41d889 (Wed Oct 9 2019)
    replaced by API routines that return errors.
  * svc_dg: Free xp_netid during destroy
  * Fix memory management issues of fd locks
  * libtirpc: replace array with list for per-fd locks
  * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf
  * __rpc_dtbsize: rlim_cur instead of rlim_max
  * pkg-config: use the correct replacements for libdir/includedir
  Patches replaced by update:
  binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467)
  0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680)
  0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752)
  0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch
  (bsc#1196647), (bsc#1200800), (bsc#1198176)
  * replaces /etc/netconfig-try-2-first by the environment variable
  RPCB_V2FIRST</changelog>
</package>
<package pkgid="8943d7bf9fa0ab95382455410a88b77ad83deedb0de51d80682176b1ffa7db64" name="libtirpc3" arch="x86_64">
  <version epoch="0" ver="1.3.4" rel="150300.3.20.1"/>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="kukuk@suse.de" date="1520251200">- Adjust include directory [bsc#1083902]</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Update to libtirpc 1.0.3
  - clnt_dg_call: Fix a buffer overflow (CVE-2016-4429)
  - Avoid choosing reserved ports in legacy RPC APIs
  - rpcinfo: change order of version to be tried to 4, 3, 2
  - includes 003-rpc-types.patch
  - includes 004-replace-bzero-with-memset.patch
  - includes 005-missing-includes.patch
  - includes 011-Fix-typo-in-src-libtirpc.map-which-prevents-that-key.patch
  - includes decls.patch
- Drop COPYING.GPLv2, GPLv2 code was removed from library</changelog>
  <changelog author="jengelh@inai.de" date="1521115200">- Remove ineffective --with-pic.</changelog>
  <changelog author="kukuk@suse.de" date="1522929600">- Revert binddynport changes as they break backward compatibility
  [brc#1562169].
  - add 002-revert-binddynport.patch</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1523534400">- fix socket leak introduced by change-rpc-protocol-version-order patch
  (bsc#1087925)
  - add 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1552305600">- Fix SLES 15 - yp_bind_client_create_v3: RPC: Unknown host (bsc#1126096).
  - Add upstream patch
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1571227200">- Updated to libtirpc 1.1.5 rc2 (this includes changes in 1.1.4 release)
  - add libtirpc-1-1-5-rc1.patch and libtirpc-1-1-5-rc2.patch to reflect
    upstream changes after 1.1.4 release
  - remove /etc/bindresvport.blacklist as it's still supported by glibc
    although it's not compiled with --enable-obsolete-rpc
- Drop patches accepted in previous releases or not needed
  - 000-bindresvport_blacklist.patch (accepted in 5b037cc9, libtirpc 1.1.4)
  - 001-new-rpcbindsock-path.patch (not needed, rpcbind now uses /var/run directory)
  - 002-revert-binddynport.patch (fixed in 2802259, libtirpc-1-0-4-rc1)
  - 0001-Fix-regression-introduced-by-change-rpc-version-orde.patch
    (backport of 25d38d7, libtirpc-1-0-4-rc1)
  - 0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
    (backport of 145272c, libtirpc-1-0-4-rc2)
- Add fixes from upcomming release
  - 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - 0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch
  - 0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1573560000">- Fix previous version:
  - actually delete
    0001-xdrstdio_create-buffers-do-not-output-encoded-values.patch
  - use 0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch
  - use 0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch (renamed from
    0003-man-rpc_secure.3t-Fix-typo-in-manpage.patch)
  - use 0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch
    (renamed from
    0004-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="pvorel@suse.cz" date="1578052800">- Update to libtirpc 1.2.5
  - A number resource leaks and other issues were fix which were identified
  by a Coverity Scan.
  - The AUTH_DES authentication has been deprecated. If any of those routines
    are called, they will fail immediately.
  - numerous bug fixes
- Package changes:
  - Build without AUTH_DES authentication
  - Add patch from next release 0001-Add-authdes_seccreate-stub.patch
    (a86b4ff Add authdes_seccreate() stub)
  - Drop rc patches (libtirpc-1-1-5-rc1.patch, libtirpc-1-1-5-rc2.patch)
  - Drop patches all patches backported from this release
  (0001-Makefile.am-Use-LIBADD-instead-of-LDFLAGS-to-link-ag.patch,
  0002-man-rpc_secure.3t-Fix-typo-in-manpage.patch,
  0003-xdr-add-a-defensive-mask-in-xdr_int64_t-and-xdr_u_in.patch)</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1580472000">- Skip unneeded autogen.sh run (configure is up-to-date), drop
  dependencies: libtool, autoconf
- Replace krb5-mini-devel/krb5-devel with pkgconfig(krb5)</changelog>
  <changelog author="pvorel@suse.cz" date="1580904000">- Backport upstream fix daed7ee ("Avoid multiple-definiton with gcc -fno-common")
  to fix build error with gcc flag -fno-common (bsc#1160875).
  Tested on gcc-9 and gcc-10.
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch</changelog>
  <changelog author="pvorel@suse.cz" date="1586952000">- Update to libtirpc 1.2.6
  - Drop patches all patches backported from this release
  (0001-Add-authdes_seccreate-stub.patch,
  0001-Avoid-multiple-definiton-with-gcc-fno-common.patch)</changelog>
  <changelog author="thomas.blume@suse.com" date="1646740800">- add option to enforce connection via protocol version 2 first
  (bsc#1196647)
  add 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1650628800">- check for nullpointer in check_address (bsc#1198176)
  update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1652184000">- fix memory leak in params.r_addr assignement (bsc#1198752)
  - add 0001-fix-parms.r_addr-memory-leak.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1658491200">-exclude ipv6 addresses in client protocol 2 code (bsc#1200800)
  - update 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1662724800">- fix CVE-2021-46828: libtirpc: DoS vulnerability with lots of
  connections (bsc#1201680)
  - add 0001-Fix-DoS-vulnerability-in-libtirpc.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1669723200">- consider /proc/sys/net/ipv4/ip_local_reserved_ports, before binding
  to a random port (bsc#1199467)
  - add binddynport-honor-ip_local_reserved_ports.patch</changelog>
  <changelog author="thomas.blume@suse.com" date="1697198400">-  update to 1.3.4 (bsc#1199467)
  * binddynport.c honor ip_local_reserved_ports
  - replaces: binddynport-honor-ip_local_reserved_ports.patch
  * gss-api: expose gss major/minor error in authgss_refresh()
  * rpcb_clnt.c: Eliminate double frees in delete_cache()
  * rpcb_clnt.c: memory leak in destroy_addr
  * portmapper: allow TCP-only portmapper
  * getnetconfigent: avoid potential DoS issue by removing unnecessary sleep
  * clnt_raw.c: fix a possible null pointer dereference
  * bindresvport.c: fix a potential resource leakage
- update to 1.3.3 (bsc#1201680, CVE-2021-46828):
  * Fix DoS vulnerability in libtirpc
  - replaces: 0001-Fix-DoS-vulnerability-in-libtirpc.patch
  * _rpc_dtablesize: use portable system call
  * libtirpc: Fix use-after-free accessing the error number
  * Fix potential memory leak of parms.r_addr
  - replaces 0001-fix-parms.r_addr-memory-leak.patch
  * rpcb_clnt.c add mechanism to try v2 protocol first
  - preplaces: 0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch
  * Eliminate deadlocks in connects with an MT environment
  * clnt_dg_freeres() uncleared set active state may deadlock
  * thread safe clnt destruction
  * SUNRPC: mutexed access blacklist_read state variable
  * SUNRPC: MT-safe overhaul of address cache management in rpcb_clnt.c
- drop 0001-Fix-DoS-vulnerability-in-libtirpc.patch (upstream)
- update to 1.3.2:
  * Replace the final SunRPC licenses with BSD licenses
  * blacklist: Add a few more well known ports
  * libtirpc: disallow calling auth_refresh from clnt_call with RPCSEC_GSS
- Update to libtirpc 1.3.1
  * Remove AUTH_DES interfaces from auth_des.h
    The unsupported  AUTH_DES authentication has be
    compiled out since commit d918e41d889 (Wed Oct 9 2019)
    replaced by API routines that return errors.
  * svc_dg: Free xp_netid during destroy
  * Fix memory management issues of fd locks
  * libtirpc: replace array with list for per-fd locks
  * __svc_vc_dodestroy: fix double free of xp_ltaddr.buf
  * __rpc_dtbsize: rlim_cur instead of rlim_max
  * pkg-config: use the correct replacements for libdir/includedir
  Patches replaced by update:
  binddynport-honor-ip_local_reserved_ports.patch (bsc#1199467)
  0001-Fix-DoS-vulnerability-in-libtirpc.patch (bsc#1201680)
  0001-fix-parms.r_addr-memory-leak.patch (bsc#1198752)
  0001-rpcb_clnt.c-config-to-try-protocolversion-2-first.patch
  (bsc#1196647), (bsc#1200800), (bsc#1198176)
  * replaces /etc/netconfig-try-2-first by the environment variable
  RPCB_V2FIRST</changelog>
</package>
<package pkgid="af8747e655a384e2fd7d9e675e235750912f501480d7ea7726708be9ed11157f" name="libudev1" arch="aarch64">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="18b4de885b310def0440b80b07d8ee6628e245802592dc53b408932426b0c5fc" name="libudev1" arch="s390x">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="1db8dd870505c71d262eb13bda138c73e84585ceecc37c755d9ef67509437b75" name="libudev1" arch="x86_64">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="186b8689f8d2e24fb4d1d91c149a37954771a2605cb96ffae4472882563476f2" name="libvmtools0" arch="x86_64">
  <version epoch="0" ver="12.3.0" rel="150300.40.1"/>
  <changelog author="dimstar@opensuse.org" date="1616760000">- Add open-vm-tools-glib-2.67.patch: Fix build with glib 2.67.
  Patch has been borrowed by Fedora, upstream is still busy working
  out a patch (I'd not be surprised if they end up merging this
  finally.
  https://github.com/vmware/open-vm-tools/issues/500</changelog>
  <changelog author="kallan@suse.com" date="1620302400">- Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools
  package fails.</changelog>
  <changelog author="kallan@suse.com" date="1624536000">- Update to 11.3.0 (build 18090558) (boo#1187567)
  + Resolved issues:
  - The following github issues and pull requests have been resolved:
    446, 481, 500, and 509
  - The following Pull requests have been resolved: 474 and 505
  - A number of issues detected by Coverity, internally or by third parties,
    have been addressed.
  - A command line tool, vmwgfxctrl, has been added to open-vm-tools for
    Linux that can be used to control various aspects of the vmwgfx Linux
    kernel module.  Currently it can both display and set the current
    topology of the vmwgfx kernel driver. It is useful when trying to
    configure custom resolutions on recent Linux distributions, including
    multi-monitor setups.
  - A command line tool, vmware-alias-import, has been added to
    open-vm-tools that can be used to import vgauth config data and apply
    it to the running vgauth service.
  - Enhancements to support or utilize various vSphere features.
- Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path
  "/var/run" to "/run" for it's PIDfile.
- Update pam-vmtoolsd.patch to compensate for new line numbers.
- Drop patch now contained in 11.3.0:
  - open-vm-tools-glib-2.67.patch
  - open-vm-tools-pollGtk.patch</changelog>
  <changelog author="kallan@suse.com" date="1633348800">- Update to 11.3.5 (build 18557794) (boo#1190987)
  + New/Updated features:
  - Added a configurable logging capability to the network script.
    The network script has been updated to:
    use vmware-toolbox-cmd to query any network logging configuration from
    the tools.conf file.  Use vmtoolsd --cmd "log ..." to log a message to
    the vmx logfile when the logging handler is configured to "vmx" or when
    the logfile is full or is not writeable.
  - The hgfsmounter (mount.vmhgfs) command has been removed from
    open-vm-tools.
    The hgfsmounter (mount.vmhgfs) command is no longer used in
    Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore,
    removing all references to the hgfsmounter in Linux builds.
  + Resolved issues:
  - Customization: Retry the Linux reboot if telinit is a soft link to
    systemctl.
  - Open-vm-tools commands would hang if configured with "--enable-valgrind".
  + Spec file updates for:
  - rpmlint errors
  - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling.</changelog>
  <changelog author="kallan@suse.com" date="1648468800">- Update to 12.0.0 (build 19345655) (boo#1196803)
- jsc#SLE-24097 ECO Update open-vm-tools 12.0.0
  + New/Updated features:
  - Support for managing Salt Minion through guest variables.  A new
    open-vm-tools-salt-minion rpm is added to handle this support.
    jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4
    jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3
    jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5
  - New ComponentMgr plugin to manage (add, remove, monitor) components on
    the guest VM.
  - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804).
  - Build vmhgfs with either libfuse2 or libfuse3.
  + A number of Coverity and Codacy reported issues have been addressed.
  + The following issues and pull requests reported on
    github.com/vmware/open-vm-tools have been addressed: Issue # 128,
    Issue # 314, Pull # 513, Pull # 544, Pull # 573
- Added patches
  + gcc_size_t.patch (boo#1196804)</changelog>
  <changelog author="kallan@suse.com" date="1661428800">- Update to 12.1.0 (build 20219665) (boo#1202733)
  + New/Updated features:
  - Contains security update fix for (bsc#1202657) - (CVE-2022-31676)
    VUL-0: CVE-2022-31676: open-vm-tools:
    local privilege escalation vulnerability
  + A number of Coverity reported issues have been addressed.
  + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux
    release:
    https://github.com/vmware/open-vm-tools/pull/588
  + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit)
    This change incorporates the support of 64 bit time epoch conversion
    from Windows NT time to Unix Epoch time on i386.
    https://github.com/vmware/open-vm-tools/pull/387
- Drop patch now contained in 12.1.0:
  + gcc_size_t.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1670500800">- Add _service to handle open-vm-tools sources
- Update to 12.1.5 (build 20735119) (boo#1205962)
  - A number of Coverity reported issues have been addressed.
  - The deployPkg plugin may prematurely reboot the guest VM before cloud-init
    has completed user data setup. If both the Perl based Linux customization
    script and cloud-init run when the guest VM boots, the deployPkg plugin
    may reboot the guest before cloud-init has finished. The deployPkg
    plugin has been updated to wait for a running cloud-init process to
    finish before the guest VM reboot is initiated. This issue is fixed in
    this release.
  - A SIGSEGV may be encountered when a non-quiesing snapshot times out.
    This issue is fixed in this release.
  - Unwanted vmtoolsd service error message if not on a VMware hypervisor.
    When open-vm-tools comes preinstalled in a base Linux release, the vmtoolsd
    services are started automatically at system start and desktop login.
    If running on physical hardware or in a non-VMware hypervisor, the services
    will emit an error message to the Systemd's logging service before stopping.
    This issue is fixed in this release.</changelog>
  <changelog author="caleb.crane@suse.com" date="1670846400">- Add containerInfo plugin (jsc-PED-1344)
  - Add dependencies on grpc, protobuf, and containerd for container
    introspection
- Added patches (jsc-PED-1344)
  + detect-suse-location.patch</changelog>
  <changelog author="kallan@suse.com" date="1670932800">- Don't use new LDFLAGS, -labsl_synchronization -lgpr, when building for SLE.</changelog>
  <changelog author="kallan@suse.com" date="1671019200">- Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires
  section.  The dependencies will be added automatically.</changelog>
  <changelog author="schubi@suse.com" date="1672228800">- Migration of PAM settings to /usr/lib/pam.d.</changelog>
  <changelog author="kallan@suse.com" date="1680004800">- Update to 12.2.0 (build 21223074) (boo#1209128)
  - There are no new features in the open-vm-tools 12.2.0 release. This is
    primarily a maintenance release that addresses a few critical problems,
    including:
  - Linux quiesced snapshots have been updated to avoid intermittent hangs of
    the vmtoolsd process.
  - Updated the guestOps to handle some edge cases when File_GetSize() fails
    or returns -1.
  - A number of Coverity reported issues have been addressed.
  - Detect the proto files for the containerd grpc client in alternate
    locations.  Pull request #626
  - FreeBSD: Support newer releases and code clean-up for earlier versions.
    Pull request #584
  - Please refer to the release notes at
    https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md
  - The granular changes that have gone into the 12.2.0 release are in the
    ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/
    open-vm-tools/ChangeLog
- Update detect-suse-location.patch to remove upstream accepted portion of the
  patch (jsc-PED-1344).</changelog>
  <changelog author="kallan@suse.com" date="1680609600">- As per jsc-PED-1344, update spec file to only build the containerinfo
  plugin for TW/SLES 15 SP5 and newer.</changelog>
  <changelog author="jengelh@inai.de" date="1683028800">- Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch,
  0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch
  [boo#1210695]
- Reduce generated script size by coalescing multiple %service_*</changelog>
  <changelog author="kallan@suse.com" date="1686571200">- Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867:
  open-vm-tools: Authentication Bypass vulnerability in the vgauth
  module
  + Add patch: 2023-20867-Remove-some-dead-code.patch</changelog>
  <changelog author="dmueller@suse.com" date="1687867200">- limit to protobuf &lt; 22 for now until build failures have been fixed</changelog>
  <changelog author="kallan@suse.com" date="1693224000">- Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900:
  open-vm-tools: SAML token signature bypass vulnerability
  + Add patch: CVE-20230-20900.patch</changelog>
  <changelog author="kallan@suse.com" date="1694001600">- Update to 12.3.0 (build 22234872) (boo#1214850)
  - There are no new features in the open-vm-tools 12.3.0 release. This is
    primarily a maintenance release that addresses a few critical problems,
    including:
  - This release integrates CVE-2023-20900 without the need for a patch.
    For more information on this vulnerability and its impact on VMware
    products, see
    https://www.vmware.com/security/advisories/VMSA-2023-0019.html.
  - A tools.conf configuration setting is available to temporaily direct
    Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior
    of ignoring file systems already frozen.
  - Building of the VMware Guest Authentication Service (VGAuth) using
    "xml-security-c" and "xerces-c" is being deprecated.
  - A number of Coverity reported issues have been addressed.
  - A number of GitHub issues and pull requests have been handled.
    Please see the Resolves Issues section of the Release Notes.
  - For issues resolved in this release, see the Resolved Issues section
    of the Release Notes.
  - For complete details, see:
    https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0
  - Release Notes are available at
    https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md
  - The granular changes that have gone into the 12.3.0 release are in the
    ChangeLog at
    https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog
- Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests
- jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4.
- Drop patch now contained in 12.3.0:
  + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch
  + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch
  + 2023-20867-Remove-some-dead-code.patch
  + CVE-20230-20900.patch</changelog>
  <changelog author="meissner@suse.com" date="1695297600">- open-vm-tools is built with containerinfo plugin from 15 sp3 onwards</changelog>
  <changelog author="kallan@suse.com" date="1695902400">- 15 sp4 currently uses open-vm-tools rpms from 15 sp3.  As such, enable
  the spec file fix for bug (bsc#1205927) for 15 sp3 onwards.</changelog>
</package>
<package pkgid="31dd6658df7ec95b4f49f7cbf77ed659f01bc7af0f4227a78399c40831498359" name="libvmtools0" arch="x86_64">
  <version epoch="0" ver="12.3.0" rel="150300.43.1"/>
  <changelog author="kallan@suse.com" date="1620302400">- Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools
  package fails.</changelog>
  <changelog author="kallan@suse.com" date="1624536000">- Update to 11.3.0 (build 18090558) (boo#1187567)
  + Resolved issues:
  - The following github issues and pull requests have been resolved:
    446, 481, 500, and 509
  - The following Pull requests have been resolved: 474 and 505
  - A number of issues detected by Coverity, internally or by third parties,
    have been addressed.
  - A command line tool, vmwgfxctrl, has been added to open-vm-tools for
    Linux that can be used to control various aspects of the vmwgfx Linux
    kernel module.  Currently it can both display and set the current
    topology of the vmwgfx kernel driver. It is useful when trying to
    configure custom resolutions on recent Linux distributions, including
    multi-monitor setups.
  - A command line tool, vmware-alias-import, has been added to
    open-vm-tools that can be used to import vgauth config data and apply
    it to the running vgauth service.
  - Enhancements to support or utilize various vSphere features.
- Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path
  "/var/run" to "/run" for it's PIDfile.
- Update pam-vmtoolsd.patch to compensate for new line numbers.
- Drop patch now contained in 11.3.0:
  - open-vm-tools-glib-2.67.patch
  - open-vm-tools-pollGtk.patch</changelog>
  <changelog author="kallan@suse.com" date="1633348800">- Update to 11.3.5 (build 18557794) (boo#1190987)
  + New/Updated features:
  - Added a configurable logging capability to the network script.
    The network script has been updated to:
    use vmware-toolbox-cmd to query any network logging configuration from
    the tools.conf file.  Use vmtoolsd --cmd "log ..." to log a message to
    the vmx logfile when the logging handler is configured to "vmx" or when
    the logfile is full or is not writeable.
  - The hgfsmounter (mount.vmhgfs) command has been removed from
    open-vm-tools.
    The hgfsmounter (mount.vmhgfs) command is no longer used in
    Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore,
    removing all references to the hgfsmounter in Linux builds.
  + Resolved issues:
  - Customization: Retry the Linux reboot if telinit is a soft link to
    systemctl.
  - Open-vm-tools commands would hang if configured with "--enable-valgrind".
  + Spec file updates for:
  - rpmlint errors
  - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling.</changelog>
  <changelog author="kallan@suse.com" date="1648468800">- Update to 12.0.0 (build 19345655) (boo#1196803)
- jsc#SLE-24097 ECO Update open-vm-tools 12.0.0
  + New/Updated features:
  - Support for managing Salt Minion through guest variables.  A new
    open-vm-tools-salt-minion rpm is added to handle this support.
    jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4
    jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3
    jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5
  - New ComponentMgr plugin to manage (add, remove, monitor) components on
    the guest VM.
  - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804).
  - Build vmhgfs with either libfuse2 or libfuse3.
  + A number of Coverity and Codacy reported issues have been addressed.
  + The following issues and pull requests reported on
    github.com/vmware/open-vm-tools have been addressed: Issue # 128,
    Issue # 314, Pull # 513, Pull # 544, Pull # 573
- Added patches
  + gcc_size_t.patch (boo#1196804)</changelog>
  <changelog author="kallan@suse.com" date="1661428800">- Update to 12.1.0 (build 20219665) (boo#1202733)
  + New/Updated features:
  - Contains security update fix for (bsc#1202657) - (CVE-2022-31676)
    VUL-0: CVE-2022-31676: open-vm-tools:
    local privilege escalation vulnerability
  + A number of Coverity reported issues have been addressed.
  + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux
    release:
    https://github.com/vmware/open-vm-tools/pull/588
  + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit)
    This change incorporates the support of 64 bit time epoch conversion
    from Windows NT time to Unix Epoch time on i386.
    https://github.com/vmware/open-vm-tools/pull/387
- Drop patch now contained in 12.1.0:
  + gcc_size_t.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1670500800">- Add _service to handle open-vm-tools sources
- Update to 12.1.5 (build 20735119) (boo#1205962)
  - A number of Coverity reported issues have been addressed.
  - The deployPkg plugin may prematurely reboot the guest VM before cloud-init
    has completed user data setup. If both the Perl based Linux customization
    script and cloud-init run when the guest VM boots, the deployPkg plugin
    may reboot the guest before cloud-init has finished. The deployPkg
    plugin has been updated to wait for a running cloud-init process to
    finish before the guest VM reboot is initiated. This issue is fixed in
    this release.
  - A SIGSEGV may be encountered when a non-quiesing snapshot times out.
    This issue is fixed in this release.
  - Unwanted vmtoolsd service error message if not on a VMware hypervisor.
    When open-vm-tools comes preinstalled in a base Linux release, the vmtoolsd
    services are started automatically at system start and desktop login.
    If running on physical hardware or in a non-VMware hypervisor, the services
    will emit an error message to the Systemd's logging service before stopping.
    This issue is fixed in this release.</changelog>
  <changelog author="caleb.crane@suse.com" date="1670846400">- Add containerInfo plugin (jsc-PED-1344)
  - Add dependencies on grpc, protobuf, and containerd for container
    introspection
- Added patches (jsc-PED-1344)
  + detect-suse-location.patch</changelog>
  <changelog author="kallan@suse.com" date="1670932800">- Don't use new LDFLAGS, -labsl_synchronization -lgpr, when building for SLE.</changelog>
  <changelog author="kallan@suse.com" date="1671019200">- Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires
  section.  The dependencies will be added automatically.</changelog>
  <changelog author="schubi@suse.com" date="1672228800">- Migration of PAM settings to /usr/lib/pam.d.</changelog>
  <changelog author="kallan@suse.com" date="1680004800">- Update to 12.2.0 (build 21223074) (boo#1209128)
  - There are no new features in the open-vm-tools 12.2.0 release. This is
    primarily a maintenance release that addresses a few critical problems,
    including:
  - Linux quiesced snapshots have been updated to avoid intermittent hangs of
    the vmtoolsd process.
  - Updated the guestOps to handle some edge cases when File_GetSize() fails
    or returns -1.
  - A number of Coverity reported issues have been addressed.
  - Detect the proto files for the containerd grpc client in alternate
    locations.  Pull request #626
  - FreeBSD: Support newer releases and code clean-up for earlier versions.
    Pull request #584
  - Please refer to the release notes at
    https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md
  - The granular changes that have gone into the 12.2.0 release are in the
    ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/
    open-vm-tools/ChangeLog
- Update detect-suse-location.patch to remove upstream accepted portion of the
  patch (jsc-PED-1344).</changelog>
  <changelog author="kallan@suse.com" date="1680609600">- As per jsc-PED-1344, update spec file to only build the containerinfo
  plugin for TW/SLES 15 SP5 and newer.</changelog>
  <changelog author="jengelh@inai.de" date="1683028800">- Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch,
  0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch
  [boo#1210695]
- Reduce generated script size by coalescing multiple %service_*</changelog>
  <changelog author="kallan@suse.com" date="1686571200">- Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867:
  open-vm-tools: Authentication Bypass vulnerability in the vgauth
  module
  + Add patch: 2023-20867-Remove-some-dead-code.patch</changelog>
  <changelog author="dmueller@suse.com" date="1687867200">- limit to protobuf &lt; 22 for now until build failures have been fixed</changelog>
  <changelog author="kallan@suse.com" date="1693224000">- Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900:
  open-vm-tools: SAML token signature bypass vulnerability
  + Add patch: CVE-20230-20900.patch</changelog>
  <changelog author="kallan@suse.com" date="1694001600">- Update to 12.3.0 (build 22234872) (boo#1214850)
  - There are no new features in the open-vm-tools 12.3.0 release. This is
    primarily a maintenance release that addresses a few critical problems,
    including:
  - This release integrates CVE-2023-20900 without the need for a patch.
    For more information on this vulnerability and its impact on VMware
    products, see
    https://www.vmware.com/security/advisories/VMSA-2023-0019.html.
  - A tools.conf configuration setting is available to temporaily direct
    Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior
    of ignoring file systems already frozen.
  - Building of the VMware Guest Authentication Service (VGAuth) using
    "xml-security-c" and "xerces-c" is being deprecated.
  - A number of Coverity reported issues have been addressed.
  - A number of GitHub issues and pull requests have been handled.
    Please see the Resolves Issues section of the Release Notes.
  - For issues resolved in this release, see the Resolved Issues section
    of the Release Notes.
  - For complete details, see:
    https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0
  - Release Notes are available at
    https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md
  - The granular changes that have gone into the 12.3.0 release are in the
    ChangeLog at
    https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog
- Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests
- jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4.
- Drop patch now contained in 12.3.0:
  + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch
  + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch
  + 2023-20867-Remove-some-dead-code.patch
  + CVE-20230-20900.patch</changelog>
  <changelog author="meissner@suse.com" date="1695297600">- open-vm-tools is built with containerinfo plugin from 15 sp3 onwards</changelog>
  <changelog author="kallan@suse.com" date="1695902400">- 15 sp4 currently uses open-vm-tools rpms from 15 sp3.  As such, enable
  the spec file fix for bug (bsc#1205927) for 15 sp3 onwards.</changelog>
  <changelog author="kallan@suse.com" date="1697803200">- Fix (bsc#1216432) - VUL-0: CVE-2023-34058: open-vm-tools: SAML token
  signature bypass vulnerability.
- Fix (bsc#1216433) - VUL-0: : CVE-2023-34059: open-vm-tools: file
  descriptor hijack vulnerability
  + Add patch:
  - CVE-2023-34058.patch
  - CVE-2023-34059.patch</changelog>
</package>
<package pkgid="46b12512ae31a7a7f40da659b180c44f97f9ca6178f6406e2aa897ccc6ee500a" name="libxkbcommon" arch="src">
  <version epoch="0" ver="1.3.0" rel="150400.3.2.2"/>
  <changelog author="jengelh@inai.de" date="1478865600">- Update to new upstream release 0.7.0
  * Added support for different "modes" of calculating consumed
    modifiers. The existing mode, based on the XKB standard, has
    proven to be unintuitive in various shortcut implementations.
  * A new mode, based on the calculation used by the GTK toolkit,
    is added. This mode is less eager to declare a modifier as
    consumed.</changelog>
  <changelog author="jengelh@inai.de" date="1484740800">- Update to new upstream release 0.7.1
  * Fixed various reported problems when the current locale is
    tr_TR.UTF-8.</changelog>
  <changelog author="jengelh@inai.de" date="1502107200">- Update to new upstream release 0.7.2
  * Added new keysym definitions from xproto.
  * New APIs: XKB_KEY_XF86Keyboard, XKB_KEY_XF86WWAN,
    XKB_KEY_XF86RFKill, XKB_KEY_XF86AudioPreset.</changelog>
  <changelog author="jayvdb@gmail.com" date="1508414400">- Allow building x11 subpackage on any distribution</changelog>
  <changelog author="jengelh@inai.de" date="1513339200">- Update to new upstream release 0.8.0
  * Added xkb_keysym_to_{upper,lower} to perform case-conversion
    directly on keysyms. This is useful in some odd cases, but
    working with the Unicode representations should be preferred
    when possible.
  * Added Unicode conversion rules for the signifblank and
    permille keysyms.
  * Fixed a bug in the parsing of XKB key type definitions where
    the number of levels were determined by the number of level
  * names*. Keymaps which omit level names were hence
    miscompiled. This regressed in version 0.4.3. Keymaps from
    xkeyboard-config were not affected since they don't omit
    level names.</changelog>
  <changelog author="jengelh@inai.de" date="1533643200">- Update to new upstream release 0.8.2 (boo#1105832)
  * Fix a few NULL-dereferences, out-of-bounds access and undefined
    behavior in the XKB text format parser.
  * CVEs fixed:     CVE-2018-15853, CVE-2018-15854, CVE-2018-15855,
    CVE-2018-15856, CVE-2018-15857, CVE-2018-15858, CVE-2018-15859,
    CVE-2018-15861, CVE-2018-15862, CVE-2018-15863, CVE-2018-15864
- run make check</changelog>
  <changelog author="jengelh@inai.de" date="1549627200">- Update to new upstream release 0.8.3
  * New APIs: XKB_KEY_XF86MonBrightnessCycle,
    XKB_KEY_XF86RotationLockToggle.</changelog>
  <changelog author="jengelh@inai.de" date="1550836800">- Update to new upstream release 0.8.4
  * Only changes to the build procedure.</changelog>
  <changelog author="jengelh@inai.de" date="1571572800">- Update to release 0.9.0
  * Move ~/.xkb to before XKB_CONFIG_ROOT. This enables the user
    to have full control of the keymap definitions, instead of
    only augmenting them.</changelog>
  <changelog author="jengelh@inai.de" date="1571659200">- Update to release 0.9.1
  * Fix context creation failing when run in privileged processes
    as defined by `secure_getenv(3)`, e.g. GDM.</changelog>
  <changelog author="jengelh@inai.de" date="1579435200">- Update to release 0.10.0
  * Fix quadratic complexity in the XKB file parser.
  * Add $XDG_CONFIG_HOME/xkb to the default search path. If
    $XDG_CONFIG_HOME is not set, $HOME/.config/xkb is used. If
    $HOME is not set, the path is not added. The XDG path is
    looked up before the existing default search path $HOME/.xkb.
  * Add support for include statements in XKB rules files.
  * Fix bug where the merge mode only applied to the first vmod
    in a "virtual_modifiers" statement.
  * Reject interpret modifier predicate with more than one value.
  * Correctly handle capitalization of the ssharp keysym.</changelog>
  <changelog author="jengelh@inai.de" date="1599393600">- Update to release 1.0.0
  * Now it is possible to add custom layouts and options at the
    system (/etc) and user (~/.config) level, at least when
    libxkbcommon is in use.
  * libxkbregistry is a C library that lists available XKB
    models, layouts and variants for a given ruleset. This is a
    separate library (.so/.pc files) and aimed at tools that
    provide a listing of available keyboard layouts to the user.
  * Add an `xkbcli` command-line utility.</changelog>
  <changelog author="jengelh@inai.de" date="1599912000">- Update to release 1.0.1
  * Make the table output of `xkbcli how-to-type` aligned.</changelog>
  <changelog author="jengelh@inai.de" date="1605873600">- Update to release 1.0.2
  * Fix a bug where a keysym that cannot be resolved in a keymap
    gets compiled to a garbage keysym. Now it is set to
    XKB_KEY_NoSymbol instead.
  * Improve the speed of xkb_x11_keymap_new_from_device() on
    repeated calls in the same xkb_context().</changelog>
  <changelog author="jengelh@inai.de" date="1606132800">- Update to release 1.0.3
  * Fix (hopefully) a segfault in xkb_x11_keymap_new_from_device()
    in some unclear situation (bug introduced in 1.0.2).
  * Fix keymaps created with xkb_x11_keymap_new_from_device() do
    not have level names (bug introduced in 0.8.0).</changelog>
  <changelog author="dimstar@opensuse.org" date="1611144000">- Fix dependency of libxkbregistry-devel: the devel package must
  require the library libxkbregistry0.</changelog>
  <changelog author="jengelh@inai.de" date="1614859200">- Update to release 1.1.0
  * Update keysym definitions to latest xorgproto. In particular,
    this adds many special keysyms corresponding to Linux evdev
    keycodes.
  * New XKB_KEY_* definitions.</changelog>
  <changelog author="jengelh@inai.de" date="1617451200">- Update to release 1.2.0
  * `xkb_x11_keymap_new_from_device()` is much faster. It now
    performs only 2 roundtrips to the X server, instead of dozens
    (in first-time calls).
  * Case-sensitive `xkb_keysym_from_name()` is much faster.
  * Keysym names of the form `0x12AB` and `U12AB` are parsed more
    strictly.
  * Compose files now have a size limit (65535 internal nodes).
  * Compose table loading (`xkb_compose_table_new_from_locale()`
    and similar) is much faster.</changelog>
  <changelog author="jengelh@inai.de" date="1618401600">- Update to release 1.2.1 [boo#1184688]
  * Fix `xkb_x11_keymap_new_from_device()` failing when the
    keymap contains key types with missing level names, like the
    one used by the `numpad:mac` option in xkeyboard-config.
    (Regressed in 1.2.0.)</changelog>
  <changelog author="jengelh@inai.de" date="1619870400">- Update to release 1.3.0
  * `xkbcli list` was changed to output YAML instead of a
    custom format.
  * Fix segmentation fault in case-insensitive
    `xkb_keysym_from_name` for certain values like the empty
    string.</changelog>
</package>
<package pkgid="5dbabe85ad7b95c1ce1d29187fc1389d38960858444e3511e6f18620ae034cbb" name="libxkbcommon0" arch="aarch64">
  <version epoch="0" ver="1.3.0" rel="150400.3.2.2"/>
  <changelog author="jengelh@inai.de" date="1478865600">- Update to new upstream release 0.7.0
  * Added support for different "modes" of calculating consumed
    modifiers. The existing mode, based on the XKB standard, has
    proven to be unintuitive in various shortcut implementations.
  * A new mode, based on the calculation used by the GTK toolkit,
    is added. This mode is less eager to declare a modifier as
    consumed.</changelog>
  <changelog author="jengelh@inai.de" date="1484740800">- Update to new upstream release 0.7.1
  * Fixed various reported problems when the current locale is
    tr_TR.UTF-8.</changelog>
  <changelog author="jengelh@inai.de" date="1502107200">- Update to new upstream release 0.7.2
  * Added new keysym definitions from xproto.
  * New APIs: XKB_KEY_XF86Keyboard, XKB_KEY_XF86WWAN,
    XKB_KEY_XF86RFKill, XKB_KEY_XF86AudioPreset.</changelog>
  <changelog author="jayvdb@gmail.com" date="1508414400">- Allow building x11 subpackage on any distribution</changelog>
  <changelog author="jengelh@inai.de" date="1513339200">- Update to new upstream release 0.8.0
  * Added xkb_keysym_to_{upper,lower} to perform case-conversion
    directly on keysyms. This is useful in some odd cases, but
    working with the Unicode representations should be preferred
    when possible.
  * Added Unicode conversion rules for the signifblank and
    permille keysyms.
  * Fixed a bug in the parsing of XKB key type definitions where
    the number of levels were determined by the number of level
  * names*. Keymaps which omit level names were hence
    miscompiled. This regressed in version 0.4.3. Keymaps from
    xkeyboard-config were not affected since they don't omit
    level names.</changelog>
  <changelog author="jengelh@inai.de" date="1533643200">- Update to new upstream release 0.8.2 (boo#1105832)
  * Fix a few NULL-dereferences, out-of-bounds access and undefined
    behavior in the XKB text format parser.
  * CVEs fixed:     CVE-2018-15853, CVE-2018-15854, CVE-2018-15855,
    CVE-2018-15856, CVE-2018-15857, CVE-2018-15858, CVE-2018-15859,
    CVE-2018-15861, CVE-2018-15862, CVE-2018-15863, CVE-2018-15864
- run make check</changelog>
  <changelog author="jengelh@inai.de" date="1549627200">- Update to new upstream release 0.8.3
  * New APIs: XKB_KEY_XF86MonBrightnessCycle,
    XKB_KEY_XF86RotationLockToggle.</changelog>
  <changelog author="jengelh@inai.de" date="1550836800">- Update to new upstream release 0.8.4
  * Only changes to the build procedure.</changelog>
  <changelog author="jengelh@inai.de" date="1571572800">- Update to release 0.9.0
  * Move ~/.xkb to before XKB_CONFIG_ROOT. This enables the user
    to have full control of the keymap definitions, instead of
    only augmenting them.</changelog>
  <changelog author="jengelh@inai.de" date="1571659200">- Update to release 0.9.1
  * Fix context creation failing when run in privileged processes
    as defined by `secure_getenv(3)`, e.g. GDM.</changelog>
  <changelog author="jengelh@inai.de" date="1579435200">- Update to release 0.10.0
  * Fix quadratic complexity in the XKB file parser.
  * Add $XDG_CONFIG_HOME/xkb to the default search path. If
    $XDG_CONFIG_HOME is not set, $HOME/.config/xkb is used. If
    $HOME is not set, the path is not added. The XDG path is
    looked up before the existing default search path $HOME/.xkb.
  * Add support for include statements in XKB rules files.
  * Fix bug where the merge mode only applied to the first vmod
    in a "virtual_modifiers" statement.
  * Reject interpret modifier predicate with more than one value.
  * Correctly handle capitalization of the ssharp keysym.</changelog>
  <changelog author="jengelh@inai.de" date="1599393600">- Update to release 1.0.0
  * Now it is possible to add custom layouts and options at the
    system (/etc) and user (~/.config) level, at least when
    libxkbcommon is in use.
  * libxkbregistry is a C library that lists available XKB
    models, layouts and variants for a given ruleset. This is a
    separate library (.so/.pc files) and aimed at tools that
    provide a listing of available keyboard layouts to the user.
  * Add an `xkbcli` command-line utility.</changelog>
  <changelog author="jengelh@inai.de" date="1599912000">- Update to release 1.0.1
  * Make the table output of `xkbcli how-to-type` aligned.</changelog>
  <changelog author="jengelh@inai.de" date="1605873600">- Update to release 1.0.2
  * Fix a bug where a keysym that cannot be resolved in a keymap
    gets compiled to a garbage keysym. Now it is set to
    XKB_KEY_NoSymbol instead.
  * Improve the speed of xkb_x11_keymap_new_from_device() on
    repeated calls in the same xkb_context().</changelog>
  <changelog author="jengelh@inai.de" date="1606132800">- Update to release 1.0.3
  * Fix (hopefully) a segfault in xkb_x11_keymap_new_from_device()
    in some unclear situation (bug introduced in 1.0.2).
  * Fix keymaps created with xkb_x11_keymap_new_from_device() do
    not have level names (bug introduced in 0.8.0).</changelog>
  <changelog author="dimstar@opensuse.org" date="1611144000">- Fix dependency of libxkbregistry-devel: the devel package must
  require the library libxkbregistry0.</changelog>
  <changelog author="jengelh@inai.de" date="1614859200">- Update to release 1.1.0
  * Update keysym definitions to latest xorgproto. In particular,
    this adds many special keysyms corresponding to Linux evdev
    keycodes.
  * New XKB_KEY_* definitions.</changelog>
  <changelog author="jengelh@inai.de" date="1617451200">- Update to release 1.2.0
  * `xkb_x11_keymap_new_from_device()` is much faster. It now
    performs only 2 roundtrips to the X server, instead of dozens
    (in first-time calls).
  * Case-sensitive `xkb_keysym_from_name()` is much faster.
  * Keysym names of the form `0x12AB` and `U12AB` are parsed more
    strictly.
  * Compose files now have a size limit (65535 internal nodes).
  * Compose table loading (`xkb_compose_table_new_from_locale()`
    and similar) is much faster.</changelog>
  <changelog author="jengelh@inai.de" date="1618401600">- Update to release 1.2.1 [boo#1184688]
  * Fix `xkb_x11_keymap_new_from_device()` failing when the
    keymap contains key types with missing level names, like the
    one used by the `numpad:mac` option in xkeyboard-config.
    (Regressed in 1.2.0.)</changelog>
  <changelog author="jengelh@inai.de" date="1619870400">- Update to release 1.3.0
  * `xkbcli list` was changed to output YAML instead of a
    custom format.
  * Fix segmentation fault in case-insensitive
    `xkb_keysym_from_name` for certain values like the empty
    string.</changelog>
</package>
<package pkgid="1abe6db607b61999611b997cda238ff062a43c9afc9bbef10320e3ebd4398f3d" name="libxkbcommon0" arch="s390x">
  <version epoch="0" ver="1.3.0" rel="150400.3.2.2"/>
  <changelog author="jengelh@inai.de" date="1478865600">- Update to new upstream release 0.7.0
  * Added support for different "modes" of calculating consumed
    modifiers. The existing mode, based on the XKB standard, has
    proven to be unintuitive in various shortcut implementations.
  * A new mode, based on the calculation used by the GTK toolkit,
    is added. This mode is less eager to declare a modifier as
    consumed.</changelog>
  <changelog author="jengelh@inai.de" date="1484740800">- Update to new upstream release 0.7.1
  * Fixed various reported problems when the current locale is
    tr_TR.UTF-8.</changelog>
  <changelog author="jengelh@inai.de" date="1502107200">- Update to new upstream release 0.7.2
  * Added new keysym definitions from xproto.
  * New APIs: XKB_KEY_XF86Keyboard, XKB_KEY_XF86WWAN,
    XKB_KEY_XF86RFKill, XKB_KEY_XF86AudioPreset.</changelog>
  <changelog author="jayvdb@gmail.com" date="1508414400">- Allow building x11 subpackage on any distribution</changelog>
  <changelog author="jengelh@inai.de" date="1513339200">- Update to new upstream release 0.8.0
  * Added xkb_keysym_to_{upper,lower} to perform case-conversion
    directly on keysyms. This is useful in some odd cases, but
    working with the Unicode representations should be preferred
    when possible.
  * Added Unicode conversion rules for the signifblank and
    permille keysyms.
  * Fixed a bug in the parsing of XKB key type definitions where
    the number of levels were determined by the number of level
  * names*. Keymaps which omit level names were hence
    miscompiled. This regressed in version 0.4.3. Keymaps from
    xkeyboard-config were not affected since they don't omit
    level names.</changelog>
  <changelog author="jengelh@inai.de" date="1533643200">- Update to new upstream release 0.8.2 (boo#1105832)
  * Fix a few NULL-dereferences, out-of-bounds access and undefined
    behavior in the XKB text format parser.
  * CVEs fixed:     CVE-2018-15853, CVE-2018-15854, CVE-2018-15855,
    CVE-2018-15856, CVE-2018-15857, CVE-2018-15858, CVE-2018-15859,
    CVE-2018-15861, CVE-2018-15862, CVE-2018-15863, CVE-2018-15864
- run make check</changelog>
  <changelog author="jengelh@inai.de" date="1549627200">- Update to new upstream release 0.8.3
  * New APIs: XKB_KEY_XF86MonBrightnessCycle,
    XKB_KEY_XF86RotationLockToggle.</changelog>
  <changelog author="jengelh@inai.de" date="1550836800">- Update to new upstream release 0.8.4
  * Only changes to the build procedure.</changelog>
  <changelog author="jengelh@inai.de" date="1571572800">- Update to release 0.9.0
  * Move ~/.xkb to before XKB_CONFIG_ROOT. This enables the user
    to have full control of the keymap definitions, instead of
    only augmenting them.</changelog>
  <changelog author="jengelh@inai.de" date="1571659200">- Update to release 0.9.1
  * Fix context creation failing when run in privileged processes
    as defined by `secure_getenv(3)`, e.g. GDM.</changelog>
  <changelog author="jengelh@inai.de" date="1579435200">- Update to release 0.10.0
  * Fix quadratic complexity in the XKB file parser.
  * Add $XDG_CONFIG_HOME/xkb to the default search path. If
    $XDG_CONFIG_HOME is not set, $HOME/.config/xkb is used. If
    $HOME is not set, the path is not added. The XDG path is
    looked up before the existing default search path $HOME/.xkb.
  * Add support for include statements in XKB rules files.
  * Fix bug where the merge mode only applied to the first vmod
    in a "virtual_modifiers" statement.
  * Reject interpret modifier predicate with more than one value.
  * Correctly handle capitalization of the ssharp keysym.</changelog>
  <changelog author="jengelh@inai.de" date="1599393600">- Update to release 1.0.0
  * Now it is possible to add custom layouts and options at the
    system (/etc) and user (~/.config) level, at least when
    libxkbcommon is in use.
  * libxkbregistry is a C library that lists available XKB
    models, layouts and variants for a given ruleset. This is a
    separate library (.so/.pc files) and aimed at tools that
    provide a listing of available keyboard layouts to the user.
  * Add an `xkbcli` command-line utility.</changelog>
  <changelog author="jengelh@inai.de" date="1599912000">- Update to release 1.0.1
  * Make the table output of `xkbcli how-to-type` aligned.</changelog>
  <changelog author="jengelh@inai.de" date="1605873600">- Update to release 1.0.2
  * Fix a bug where a keysym that cannot be resolved in a keymap
    gets compiled to a garbage keysym. Now it is set to
    XKB_KEY_NoSymbol instead.
  * Improve the speed of xkb_x11_keymap_new_from_device() on
    repeated calls in the same xkb_context().</changelog>
  <changelog author="jengelh@inai.de" date="1606132800">- Update to release 1.0.3
  * Fix (hopefully) a segfault in xkb_x11_keymap_new_from_device()
    in some unclear situation (bug introduced in 1.0.2).
  * Fix keymaps created with xkb_x11_keymap_new_from_device() do
    not have level names (bug introduced in 0.8.0).</changelog>
  <changelog author="dimstar@opensuse.org" date="1611144000">- Fix dependency of libxkbregistry-devel: the devel package must
  require the library libxkbregistry0.</changelog>
  <changelog author="jengelh@inai.de" date="1614859200">- Update to release 1.1.0
  * Update keysym definitions to latest xorgproto. In particular,
    this adds many special keysyms corresponding to Linux evdev
    keycodes.
  * New XKB_KEY_* definitions.</changelog>
  <changelog author="jengelh@inai.de" date="1617451200">- Update to release 1.2.0
  * `xkb_x11_keymap_new_from_device()` is much faster. It now
    performs only 2 roundtrips to the X server, instead of dozens
    (in first-time calls).
  * Case-sensitive `xkb_keysym_from_name()` is much faster.
  * Keysym names of the form `0x12AB` and `U12AB` are parsed more
    strictly.
  * Compose files now have a size limit (65535 internal nodes).
  * Compose table loading (`xkb_compose_table_new_from_locale()`
    and similar) is much faster.</changelog>
  <changelog author="jengelh@inai.de" date="1618401600">- Update to release 1.2.1 [boo#1184688]
  * Fix `xkb_x11_keymap_new_from_device()` failing when the
    keymap contains key types with missing level names, like the
    one used by the `numpad:mac` option in xkeyboard-config.
    (Regressed in 1.2.0.)</changelog>
  <changelog author="jengelh@inai.de" date="1619870400">- Update to release 1.3.0
  * `xkbcli list` was changed to output YAML instead of a
    custom format.
  * Fix segmentation fault in case-insensitive
    `xkb_keysym_from_name` for certain values like the empty
    string.</changelog>
</package>
<package pkgid="c3792c33b70e3dd9afb6f0859c60cd62f148a9492f1dd78bc412d4e49b72de61" name="libxkbcommon0" arch="x86_64">
  <version epoch="0" ver="1.3.0" rel="150400.3.2.2"/>
  <changelog author="jengelh@inai.de" date="1478865600">- Update to new upstream release 0.7.0
  * Added support for different "modes" of calculating consumed
    modifiers. The existing mode, based on the XKB standard, has
    proven to be unintuitive in various shortcut implementations.
  * A new mode, based on the calculation used by the GTK toolkit,
    is added. This mode is less eager to declare a modifier as
    consumed.</changelog>
  <changelog author="jengelh@inai.de" date="1484740800">- Update to new upstream release 0.7.1
  * Fixed various reported problems when the current locale is
    tr_TR.UTF-8.</changelog>
  <changelog author="jengelh@inai.de" date="1502107200">- Update to new upstream release 0.7.2
  * Added new keysym definitions from xproto.
  * New APIs: XKB_KEY_XF86Keyboard, XKB_KEY_XF86WWAN,
    XKB_KEY_XF86RFKill, XKB_KEY_XF86AudioPreset.</changelog>
  <changelog author="jayvdb@gmail.com" date="1508414400">- Allow building x11 subpackage on any distribution</changelog>
  <changelog author="jengelh@inai.de" date="1513339200">- Update to new upstream release 0.8.0
  * Added xkb_keysym_to_{upper,lower} to perform case-conversion
    directly on keysyms. This is useful in some odd cases, but
    working with the Unicode representations should be preferred
    when possible.
  * Added Unicode conversion rules for the signifblank and
    permille keysyms.
  * Fixed a bug in the parsing of XKB key type definitions where
    the number of levels were determined by the number of level
  * names*. Keymaps which omit level names were hence
    miscompiled. This regressed in version 0.4.3. Keymaps from
    xkeyboard-config were not affected since they don't omit
    level names.</changelog>
  <changelog author="jengelh@inai.de" date="1533643200">- Update to new upstream release 0.8.2 (boo#1105832)
  * Fix a few NULL-dereferences, out-of-bounds access and undefined
    behavior in the XKB text format parser.
  * CVEs fixed:     CVE-2018-15853, CVE-2018-15854, CVE-2018-15855,
    CVE-2018-15856, CVE-2018-15857, CVE-2018-15858, CVE-2018-15859,
    CVE-2018-15861, CVE-2018-15862, CVE-2018-15863, CVE-2018-15864
- run make check</changelog>
  <changelog author="jengelh@inai.de" date="1549627200">- Update to new upstream release 0.8.3
  * New APIs: XKB_KEY_XF86MonBrightnessCycle,
    XKB_KEY_XF86RotationLockToggle.</changelog>
  <changelog author="jengelh@inai.de" date="1550836800">- Update to new upstream release 0.8.4
  * Only changes to the build procedure.</changelog>
  <changelog author="jengelh@inai.de" date="1571572800">- Update to release 0.9.0
  * Move ~/.xkb to before XKB_CONFIG_ROOT. This enables the user
    to have full control of the keymap definitions, instead of
    only augmenting them.</changelog>
  <changelog author="jengelh@inai.de" date="1571659200">- Update to release 0.9.1
  * Fix context creation failing when run in privileged processes
    as defined by `secure_getenv(3)`, e.g. GDM.</changelog>
  <changelog author="jengelh@inai.de" date="1579435200">- Update to release 0.10.0
  * Fix quadratic complexity in the XKB file parser.
  * Add $XDG_CONFIG_HOME/xkb to the default search path. If
    $XDG_CONFIG_HOME is not set, $HOME/.config/xkb is used. If
    $HOME is not set, the path is not added. The XDG path is
    looked up before the existing default search path $HOME/.xkb.
  * Add support for include statements in XKB rules files.
  * Fix bug where the merge mode only applied to the first vmod
    in a "virtual_modifiers" statement.
  * Reject interpret modifier predicate with more than one value.
  * Correctly handle capitalization of the ssharp keysym.</changelog>
  <changelog author="jengelh@inai.de" date="1599393600">- Update to release 1.0.0
  * Now it is possible to add custom layouts and options at the
    system (/etc) and user (~/.config) level, at least when
    libxkbcommon is in use.
  * libxkbregistry is a C library that lists available XKB
    models, layouts and variants for a given ruleset. This is a
    separate library (.so/.pc files) and aimed at tools that
    provide a listing of available keyboard layouts to the user.
  * Add an `xkbcli` command-line utility.</changelog>
  <changelog author="jengelh@inai.de" date="1599912000">- Update to release 1.0.1
  * Make the table output of `xkbcli how-to-type` aligned.</changelog>
  <changelog author="jengelh@inai.de" date="1605873600">- Update to release 1.0.2
  * Fix a bug where a keysym that cannot be resolved in a keymap
    gets compiled to a garbage keysym. Now it is set to
    XKB_KEY_NoSymbol instead.
  * Improve the speed of xkb_x11_keymap_new_from_device() on
    repeated calls in the same xkb_context().</changelog>
  <changelog author="jengelh@inai.de" date="1606132800">- Update to release 1.0.3
  * Fix (hopefully) a segfault in xkb_x11_keymap_new_from_device()
    in some unclear situation (bug introduced in 1.0.2).
  * Fix keymaps created with xkb_x11_keymap_new_from_device() do
    not have level names (bug introduced in 0.8.0).</changelog>
  <changelog author="dimstar@opensuse.org" date="1611144000">- Fix dependency of libxkbregistry-devel: the devel package must
  require the library libxkbregistry0.</changelog>
  <changelog author="jengelh@inai.de" date="1614859200">- Update to release 1.1.0
  * Update keysym definitions to latest xorgproto. In particular,
    this adds many special keysyms corresponding to Linux evdev
    keycodes.
  * New XKB_KEY_* definitions.</changelog>
  <changelog author="jengelh@inai.de" date="1617451200">- Update to release 1.2.0
  * `xkb_x11_keymap_new_from_device()` is much faster. It now
    performs only 2 roundtrips to the X server, instead of dozens
    (in first-time calls).
  * Case-sensitive `xkb_keysym_from_name()` is much faster.
  * Keysym names of the form `0x12AB` and `U12AB` are parsed more
    strictly.
  * Compose files now have a size limit (65535 internal nodes).
  * Compose table loading (`xkb_compose_table_new_from_locale()`
    and similar) is much faster.</changelog>
  <changelog author="jengelh@inai.de" date="1618401600">- Update to release 1.2.1 [boo#1184688]
  * Fix `xkb_x11_keymap_new_from_device()` failing when the
    keymap contains key types with missing level names, like the
    one used by the `numpad:mac` option in xkeyboard-config.
    (Regressed in 1.2.0.)</changelog>
  <changelog author="jengelh@inai.de" date="1619870400">- Update to release 1.3.0
  * `xkbcli list` was changed to output YAML instead of a
    custom format.
  * Fix segmentation fault in case-insensitive
    `xkb_keysym_from_name` for certain values like the empty
    string.</changelog>
</package>
<package pkgid="59a9be44f564c5e93b42c3a29e0618a25393e6f383a912e714f45c1f5a094b07" name="libxml2-2" arch="aarch64">
  <version epoch="0" ver="2.10.3" rel="150500.5.8.1"/>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1622548800">- Update to version 2.9.12
  * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879),
    CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595,
    CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928)
  * Fix null deref in legacy SAX1 parser
  * Fix handling of unexpected EOF in xmlParseContent
  * Fix user-after-free
  * Validate UTF8 in xmlEncodeEntities
  * Fix memory leak in xmlParseElementMixedContentDecl
  * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin
  * Fix SEGV in xmlSAXParseFileWithData
  * Don't process siblings of root in xmlXIncludeProcess
  * Full changes: http://xmlsoft.org/news.html
- Drop upstream fixed
  * libxml2-CVE-2021-3541.patch
  * libxml2-CVE-2021-3537.patch
  * libxml2-CVE-2021-3518.patch
  * libxml2-CVE-2021-3517.patch
  * libxml2-CVE-2021-3516.patch
  * libxml2-CVE-2020-7595.patch
  * libxml2-CVE-2019-20388.patch
  * libxml2-CVE-2020-24977.patch
  * libxml2-CVE-2019-19956.patch
  * libxml2-python39.patch
  * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch
- Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch
- Drop since 2.8.0 merged fix-perl.diff
- Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Fix python-lxml regression with libxml2 2.9.12:
  * Work around lxml API abuse:
    gitlab.gnome.org/GNOME/libxml2/issues/255
- Add upstream patches:
  * libxml2-fix-lxml-corrupted-subtree-structures.patch
  * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch</changelog>
  <changelog author="mcepl@suse.com" date="1634731200">- Rewrite package to the single-spec %python_subpackage_only style and
  eliminate unnecessary multibuild.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1646740800">- Update to version 2.9.13:
  * Security fixes:
    + [CVE-2022-23308] Use-after-free of ID and IDREF attributes
    (boo#1196490);
    + Several memory leaks and another issues.
  * Many regressions fixes.
  * Numerous bug fixes, including, among many others:
    + xmllint's --maxmem option should work as expected now;
    + xmllint now returns an error if arguments are missing.
  * Numerous tests and code and fuzzing fixes and improvements.
  * Updated documentation.
- The full Libxml2 2.9.13 NEWS can be found here:
  https://download.gnome.org/sources/libxml2/2.9/\
  libxml2-2.9.13.news.
- Replace version-release macros in all 3 Obsoletes tag with
  plain 2.9.13 to avoid unwanted behaviors in the future.
- Remove dropped upstream AUTHORS file from list of files to be
  installed in the documentation location with 'cp' command.
- Update http://xmlsoft.org URL tag to Libxml2's new web home:
  https://gitlab.gnome.org/GNOME/libxml2.
- Update ftp://xmlsoft.org Source tag to Libxml2's new download
  host: https://download.gnome.org.
- Drop deprecated Python-2-related macro definitions/conditional
  statement from spec file.
- Drop merged upstream patches:
  libxml2-fix-lxml-corrupted-subtree-structures.patch;
  libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch.
- Drop libxml2.keyring source file as the new download host doesn't
  offer GPG signatures.
- Use ldconfig_scriptlets macro for post(un) handling.</changelog>
  <changelog author="dimstar@opensuse.org" date="1647604800">- Build python bindings in a 2nd run, using multibuild: otherwise,
  libxml2 requires pkgconfig(libxml-2.0) to build, causing issues
  to bootstrap.</changelog>
  <changelog author="david.anes@suse.com" date="1651492800">- Update to 2.9.14:
  * Security:
    + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
    + Fix potential double-free in xmlXPtrStringRangeFunction
    + Fix memory leak in xmlFindCharEncodingHandler
    + Normalize XPath strings in-place
    + Prevent integer-overflow in htmlSkipBlankChars() and
    xmlSkipBlankChars()
    + Fix leak of xmlElementContent
  * Bug fixes:
    + Fix parsing of subtracted regex character classes
    + Fix recursion check in xinclude.c
    + Reset last error in xmlCleanupGlobals
    + Fix certain combinations of regex range quantifiers
    + Fix range quantifier on subregex
  * Improvements:
    + Fix recovery from invalid HTML start tags
  * Build system, portability:
    + Define LFS macros before including system headers
    + Initialize XPath floating-point globals
    + configure: check for icu DEFS
    + configure.ac: produce tar.xz only (GNOME policy)
    + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
    + Fix build with older Python versions
    + Fix --without-valid build</changelog>
  <changelog author="david.anes@suse.com" date="1660824000">- Update to 2.10.0:
  * Security
    + [CVE-2022-2309] Reset nsNr in xmlCtxtReset
    + Reserve byte for NUL terminator and report errors consistently in xmlBuf and
    xmlBuffer
    + Fix missing NUL terminators in xmlBuf and xmlBuffer functions
    + Fix integer overflow in xmlBufferDump()
    + xmlBufAvail() should return length without including a byte for NUL
    terminator
    + Fix ownership of xmlNodePtr &amp; xmlAttrPtr fields in xmlSetTreeDoc()
    + Use xmlNewDocText in xmlXIncludeCopyRange
    + Fix use-after-free bugs when calling xmlTextReaderClose() before
    xmlFreeTextReader() on post-validating parser
    + Use UPDATE_COMPAT() consistently in buf.c
    + fix: xmlXPathParserContext could be double-delete in  OOM case.
  * Removals and deprecations
    + Disable XPointer location support by default
    + Remove outdated xml2Conf.sh
    + Deprecate module init and cleanup functions
    + Remove obsolete XML Software Autoupdate (XSA) file
    + Remove DOCBparser
    + Remove obsolete Python test framework
    + Remove broken VxWorks support
    + Remove broken Mac OS 9 support
    + Remove broken bakefile support
    + Remove broken Visual Studio 2010 support
    + Remove broken Windows CE support
    + Deprecate IDREF-related functions in valid.h
    + Deprecate legacy functions
    + Disable legacy support by default
    + Deprecate all functions in nanoftp.h
    + Disable FTP support by default
    + Add XML_DEPRECATED macro
    + Remove elfgcchack.h
  * Regressions
    + Skip incorrectly opened HTML comments
    + Restore behavior of htmlDocContentDumpFormatOutput()
  * Bug fixes
    + Fix memory leak with invalid XSD
    + Make XPath depth check work with recursive invocations
    + Fix memory leak in xmlLoadEntityContent error path
    + Avoid double-free if malloc fails in inputPush
    + Properly fold whitespace around the QName value when validating an XSD
    schema.
    + Add whitespace folding for some atomic data types that it's missing on.
    + Don't add IDs containing unexpanded entity references
  * Improvements
    + Avoid calling xmlSetTreeDoc
    + Simplify xmlFreeNode
    + Don't reset nsDef when changing node content
    + Fix unintended fall-through in xmlNodeAddContentLen
    + Remove unused xmlBuf functions
    + Implement xpath1() XPointer scheme
    + Add configuration flag for XPointer locations support
    + Fix compiler warnings in Python code
    + Mark more static data as `const`
    + Make xmlStaticCopyNode non-recursive
    + Clean up encoding switching code
    + Simplify recursive pthread mutex
    + Use non-recursive mutex in dict.c
    + Fix parser progress checks
    + Avoid arithmetic on freed pointers
    + Improve buffer allocation scheme
    + Remove unneeded #includes
    + Add support for some non-standard escapes in regular expressions.
    + htmlParseComment: handle abruptly-closed comments
    + Add let variable tag support
    + Add value-of tag support
    + Remove useless call to xmlRelaxNGCleanupTypes
    + Don't include ICU headers in public headers
    + Update `xmlStrlen()` to use POSIX / ISO C `strlen()`
    + Fix unused variable warnings with disabled features
    + Only warn on invalid redeclarations of predefined entities
    + Remove unneeded code in xmlreader.c
    + Rework validation context flags
  * Portability
    + Use NAN/INFINITY if available to init XPath NaN/Inf
    + Fix Python tests on macOS
    + Fix xmlCleanupThreads on Windows
    + Fix reinitialization of library on Windows
    + Don't mix declarations and code in runtest.c
    + Use portable python shebangs
    + Use critical sections as mutex on Windows
    + Don't set HAVE_WIN32_THREADS in win32config.h
    + Use stdint.h with newer MSVC
    + Remove cruft from win32config.h
    + Remove isinf/isnan emulation in win32config.h
    + Always fopen files with "rb"
    + Remove __DJGPP__ checks
    + Remove useless __CYGWIN__ checks
  * Build system
    + Don't autogenerate doc/examples/Makefile.am
    + cmake: Install libxml.m4 on UNIX-like platforms
    + cmake: Use symbol versioning on UNIX-like platforms
    + Port genUnicode.py to Python 3
    + Port gentest.py to Python 3
    + cmake: Fix build without thread support
    + cmake: Install documentation in CMAKE_INSTALL_DOCDIR
    + cmake: Remove non needed files in docs dir
    + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set
    + Move local Autoconf macros into m4 directory
    + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD
    + Update libxml-2.0-uninstalled.pc.in
    + Remove LIBS from XML_PRIVATE_LIBS
    + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS
    + Don't overlink executables
    + cmake: Adjust paths for UNIX or UNIX-like target systems
    + build: Make use of variables in libxml's pkg-config file
    + Avoid obsolescent `test -a` constructs
    + Move AM_MAINTAINER_MODE to AM section
    + configure.ac: make AM_SILENT_RULES([yes]) unconditional
    + Streamline documentation installation
    + Don't try to recreate COPYING symlink
    + Detect libm using libtool's macros
    + configure.ac: disable static libraries by default
    + python/Makefile.am: nest python docs in $(docdir)
    + python/Makefile.am: rely on global AM_INIT_AUTOMAKE
    + Makefile.am: install examples more idiomatically
    + configure.ac: remove useless AC_SUBST
    + Respect `--sysconfdir` in source files
    + Ignore configure backup file created by recent autoreconf too
    + Only install *.html and *.c example files
    + Remove --with-html-dir option
    + Rework documentation build system
    + Remove old website
    + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings
    + Update genChRanges.py
    + Update build_glob.py
    + Remove ICONV_CONST test
    + Remove obsolete AC_HEADER checks
    + Don't check for standard C89 library functions
    + Don't check for standard C89 headers
    + Remove special configuration for certain maintainers
  * Test suite, CI
    + Disable network in API tests
    + testapi: remove leading slash from "/missing.xml"
    + Build Autotools CI tests out of source tree (VPATH)
    + Add --with-minimum build to CI tests
    + Fix warnings when testing --with-minimum build
    + cmake: Run all tests when threads are disabled
    + Also build CI tests with -Werror
    + Move doc/examples tests to new test suite
    + Simplify 'make check' targets
    + Fix schemas and relaxng tests
    + Remove unused result files
    + Allow missing result files in runtest
    + Move regexp tests to runtest
    + Move SVG tests to runtest.c
    + Move testModule to new test suite
    + Move testThreads to new test suite
    + Remove major parts of old test suite
    + Make testchar return an error on failure
    + Add CI job for static build
    + python/tests: open() relative to test scripts
    + Port some test scripts to Python 3
  * Documentation
    + Improve documentation of tree manipulation API
    + Update xml2-config man page
    + Consolidate man pages
    + Rename xmlcatalog_man.xml
    + Make examples a standalone HTML page
    + Fix documentation in entities.c
    + Add note about optimization flags</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661428800">- Update to version 2.10.1:
  * Regressions: Fix xmlCtxtReadDoc with encoding
  * Bug fixes: Fix HTML parser with threads and --without-legacy
  * Build system:
    + Fix build with Python 3.10
    + cmake: Disable version script on macOS
    + Remove Makefile rule to build testapi.c
  * Documentation:
    + Switch back to HTML output for API documentation
    + Port doc/examples/index.py to Python 3
    + Fix order of exports in libxml2-api.xml
    + Remove libxml2-refs.xml</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661860800">- Update to version 2.10.2:
  * Improvements:
    + Remove set-but-unused variable in xmlXPathScanName
    + Silence -Warray-bounds warning
  * Build system
    + build: require automake-1.16.3 or later
    + Remove generated files from distribution
  * Test suite: Don't create missing.xml when running testapi
- Add configure --with-python=%{__python3} inbefore python build,
  as upstream no longer ships pre-grenerated files.
- Use sed to fix env-script-interpreter in documentation example.
- Pass with-ftp to configure, build ftp support.</changelog>
  <changelog author="pmonreal@suse.com" date="1662033600">- Build for now with --with-legacy to enable APIs that have been
  deprecated recently. (bsc#1202965)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1665748800">- Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304):
  + Security:
  - [CVE-2022-40304] Fix dict corruption caused by entity
    reference cycles
  - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE
  - Fix overflow check in SAX2.c
  + Build system: cmake: Set SOVERSION
- Rebase patches with quilt.</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
  <changelog author="daniel.garcia@suse.com" date="1681905600">- Build also for modern python version (jsc#PED-68)</changelog>
  <changelog author="david.anes@suse.com" date="1682078400">- Remove unneeded dependency (bsc#1209918).</changelog>
  <changelog author="david.anes@suse.com" date="1682078401">- Security update:
  * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings
    isn't deterministic
  - Added patch libxml2-CVE-2023-29469.patch
  * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in
    xmlSchemaFixupComplexType
  - Added patch libxml2-CVE-2023-28484-1.patch
  - Added patch libxml2-CVE-2023-28484-2.patch</changelog>
  <changelog author="david.anes@suse.com" date="1693828800">- Security update:
  * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global
    buffer overflow
  - Added file libxml2-CVE-2023-39615.patch</changelog>
</package>
<package pkgid="50ddcae1dfb04e293832cdc86b5fca3a46844e8b7138dd75301e4d2568483f67" name="libxml2-2" arch="s390x">
  <version epoch="0" ver="2.10.3" rel="150500.5.8.1"/>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1622548800">- Update to version 2.9.12
  * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879),
    CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595,
    CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928)
  * Fix null deref in legacy SAX1 parser
  * Fix handling of unexpected EOF in xmlParseContent
  * Fix user-after-free
  * Validate UTF8 in xmlEncodeEntities
  * Fix memory leak in xmlParseElementMixedContentDecl
  * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin
  * Fix SEGV in xmlSAXParseFileWithData
  * Don't process siblings of root in xmlXIncludeProcess
  * Full changes: http://xmlsoft.org/news.html
- Drop upstream fixed
  * libxml2-CVE-2021-3541.patch
  * libxml2-CVE-2021-3537.patch
  * libxml2-CVE-2021-3518.patch
  * libxml2-CVE-2021-3517.patch
  * libxml2-CVE-2021-3516.patch
  * libxml2-CVE-2020-7595.patch
  * libxml2-CVE-2019-20388.patch
  * libxml2-CVE-2020-24977.patch
  * libxml2-CVE-2019-19956.patch
  * libxml2-python39.patch
  * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch
- Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch
- Drop since 2.8.0 merged fix-perl.diff
- Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Fix python-lxml regression with libxml2 2.9.12:
  * Work around lxml API abuse:
    gitlab.gnome.org/GNOME/libxml2/issues/255
- Add upstream patches:
  * libxml2-fix-lxml-corrupted-subtree-structures.patch
  * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch</changelog>
  <changelog author="mcepl@suse.com" date="1634731200">- Rewrite package to the single-spec %python_subpackage_only style and
  eliminate unnecessary multibuild.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1646740800">- Update to version 2.9.13:
  * Security fixes:
    + [CVE-2022-23308] Use-after-free of ID and IDREF attributes
    (boo#1196490);
    + Several memory leaks and another issues.
  * Many regressions fixes.
  * Numerous bug fixes, including, among many others:
    + xmllint's --maxmem option should work as expected now;
    + xmllint now returns an error if arguments are missing.
  * Numerous tests and code and fuzzing fixes and improvements.
  * Updated documentation.
- The full Libxml2 2.9.13 NEWS can be found here:
  https://download.gnome.org/sources/libxml2/2.9/\
  libxml2-2.9.13.news.
- Replace version-release macros in all 3 Obsoletes tag with
  plain 2.9.13 to avoid unwanted behaviors in the future.
- Remove dropped upstream AUTHORS file from list of files to be
  installed in the documentation location with 'cp' command.
- Update http://xmlsoft.org URL tag to Libxml2's new web home:
  https://gitlab.gnome.org/GNOME/libxml2.
- Update ftp://xmlsoft.org Source tag to Libxml2's new download
  host: https://download.gnome.org.
- Drop deprecated Python-2-related macro definitions/conditional
  statement from spec file.
- Drop merged upstream patches:
  libxml2-fix-lxml-corrupted-subtree-structures.patch;
  libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch.
- Drop libxml2.keyring source file as the new download host doesn't
  offer GPG signatures.
- Use ldconfig_scriptlets macro for post(un) handling.</changelog>
  <changelog author="dimstar@opensuse.org" date="1647604800">- Build python bindings in a 2nd run, using multibuild: otherwise,
  libxml2 requires pkgconfig(libxml-2.0) to build, causing issues
  to bootstrap.</changelog>
  <changelog author="david.anes@suse.com" date="1651492800">- Update to 2.9.14:
  * Security:
    + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
    + Fix potential double-free in xmlXPtrStringRangeFunction
    + Fix memory leak in xmlFindCharEncodingHandler
    + Normalize XPath strings in-place
    + Prevent integer-overflow in htmlSkipBlankChars() and
    xmlSkipBlankChars()
    + Fix leak of xmlElementContent
  * Bug fixes:
    + Fix parsing of subtracted regex character classes
    + Fix recursion check in xinclude.c
    + Reset last error in xmlCleanupGlobals
    + Fix certain combinations of regex range quantifiers
    + Fix range quantifier on subregex
  * Improvements:
    + Fix recovery from invalid HTML start tags
  * Build system, portability:
    + Define LFS macros before including system headers
    + Initialize XPath floating-point globals
    + configure: check for icu DEFS
    + configure.ac: produce tar.xz only (GNOME policy)
    + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
    + Fix build with older Python versions
    + Fix --without-valid build</changelog>
  <changelog author="david.anes@suse.com" date="1660824000">- Update to 2.10.0:
  * Security
    + [CVE-2022-2309] Reset nsNr in xmlCtxtReset
    + Reserve byte for NUL terminator and report errors consistently in xmlBuf and
    xmlBuffer
    + Fix missing NUL terminators in xmlBuf and xmlBuffer functions
    + Fix integer overflow in xmlBufferDump()
    + xmlBufAvail() should return length without including a byte for NUL
    terminator
    + Fix ownership of xmlNodePtr &amp; xmlAttrPtr fields in xmlSetTreeDoc()
    + Use xmlNewDocText in xmlXIncludeCopyRange
    + Fix use-after-free bugs when calling xmlTextReaderClose() before
    xmlFreeTextReader() on post-validating parser
    + Use UPDATE_COMPAT() consistently in buf.c
    + fix: xmlXPathParserContext could be double-delete in  OOM case.
  * Removals and deprecations
    + Disable XPointer location support by default
    + Remove outdated xml2Conf.sh
    + Deprecate module init and cleanup functions
    + Remove obsolete XML Software Autoupdate (XSA) file
    + Remove DOCBparser
    + Remove obsolete Python test framework
    + Remove broken VxWorks support
    + Remove broken Mac OS 9 support
    + Remove broken bakefile support
    + Remove broken Visual Studio 2010 support
    + Remove broken Windows CE support
    + Deprecate IDREF-related functions in valid.h
    + Deprecate legacy functions
    + Disable legacy support by default
    + Deprecate all functions in nanoftp.h
    + Disable FTP support by default
    + Add XML_DEPRECATED macro
    + Remove elfgcchack.h
  * Regressions
    + Skip incorrectly opened HTML comments
    + Restore behavior of htmlDocContentDumpFormatOutput()
  * Bug fixes
    + Fix memory leak with invalid XSD
    + Make XPath depth check work with recursive invocations
    + Fix memory leak in xmlLoadEntityContent error path
    + Avoid double-free if malloc fails in inputPush
    + Properly fold whitespace around the QName value when validating an XSD
    schema.
    + Add whitespace folding for some atomic data types that it's missing on.
    + Don't add IDs containing unexpanded entity references
  * Improvements
    + Avoid calling xmlSetTreeDoc
    + Simplify xmlFreeNode
    + Don't reset nsDef when changing node content
    + Fix unintended fall-through in xmlNodeAddContentLen
    + Remove unused xmlBuf functions
    + Implement xpath1() XPointer scheme
    + Add configuration flag for XPointer locations support
    + Fix compiler warnings in Python code
    + Mark more static data as `const`
    + Make xmlStaticCopyNode non-recursive
    + Clean up encoding switching code
    + Simplify recursive pthread mutex
    + Use non-recursive mutex in dict.c
    + Fix parser progress checks
    + Avoid arithmetic on freed pointers
    + Improve buffer allocation scheme
    + Remove unneeded #includes
    + Add support for some non-standard escapes in regular expressions.
    + htmlParseComment: handle abruptly-closed comments
    + Add let variable tag support
    + Add value-of tag support
    + Remove useless call to xmlRelaxNGCleanupTypes
    + Don't include ICU headers in public headers
    + Update `xmlStrlen()` to use POSIX / ISO C `strlen()`
    + Fix unused variable warnings with disabled features
    + Only warn on invalid redeclarations of predefined entities
    + Remove unneeded code in xmlreader.c
    + Rework validation context flags
  * Portability
    + Use NAN/INFINITY if available to init XPath NaN/Inf
    + Fix Python tests on macOS
    + Fix xmlCleanupThreads on Windows
    + Fix reinitialization of library on Windows
    + Don't mix declarations and code in runtest.c
    + Use portable python shebangs
    + Use critical sections as mutex on Windows
    + Don't set HAVE_WIN32_THREADS in win32config.h
    + Use stdint.h with newer MSVC
    + Remove cruft from win32config.h
    + Remove isinf/isnan emulation in win32config.h
    + Always fopen files with "rb"
    + Remove __DJGPP__ checks
    + Remove useless __CYGWIN__ checks
  * Build system
    + Don't autogenerate doc/examples/Makefile.am
    + cmake: Install libxml.m4 on UNIX-like platforms
    + cmake: Use symbol versioning on UNIX-like platforms
    + Port genUnicode.py to Python 3
    + Port gentest.py to Python 3
    + cmake: Fix build without thread support
    + cmake: Install documentation in CMAKE_INSTALL_DOCDIR
    + cmake: Remove non needed files in docs dir
    + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set
    + Move local Autoconf macros into m4 directory
    + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD
    + Update libxml-2.0-uninstalled.pc.in
    + Remove LIBS from XML_PRIVATE_LIBS
    + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS
    + Don't overlink executables
    + cmake: Adjust paths for UNIX or UNIX-like target systems
    + build: Make use of variables in libxml's pkg-config file
    + Avoid obsolescent `test -a` constructs
    + Move AM_MAINTAINER_MODE to AM section
    + configure.ac: make AM_SILENT_RULES([yes]) unconditional
    + Streamline documentation installation
    + Don't try to recreate COPYING symlink
    + Detect libm using libtool's macros
    + configure.ac: disable static libraries by default
    + python/Makefile.am: nest python docs in $(docdir)
    + python/Makefile.am: rely on global AM_INIT_AUTOMAKE
    + Makefile.am: install examples more idiomatically
    + configure.ac: remove useless AC_SUBST
    + Respect `--sysconfdir` in source files
    + Ignore configure backup file created by recent autoreconf too
    + Only install *.html and *.c example files
    + Remove --with-html-dir option
    + Rework documentation build system
    + Remove old website
    + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings
    + Update genChRanges.py
    + Update build_glob.py
    + Remove ICONV_CONST test
    + Remove obsolete AC_HEADER checks
    + Don't check for standard C89 library functions
    + Don't check for standard C89 headers
    + Remove special configuration for certain maintainers
  * Test suite, CI
    + Disable network in API tests
    + testapi: remove leading slash from "/missing.xml"
    + Build Autotools CI tests out of source tree (VPATH)
    + Add --with-minimum build to CI tests
    + Fix warnings when testing --with-minimum build
    + cmake: Run all tests when threads are disabled
    + Also build CI tests with -Werror
    + Move doc/examples tests to new test suite
    + Simplify 'make check' targets
    + Fix schemas and relaxng tests
    + Remove unused result files
    + Allow missing result files in runtest
    + Move regexp tests to runtest
    + Move SVG tests to runtest.c
    + Move testModule to new test suite
    + Move testThreads to new test suite
    + Remove major parts of old test suite
    + Make testchar return an error on failure
    + Add CI job for static build
    + python/tests: open() relative to test scripts
    + Port some test scripts to Python 3
  * Documentation
    + Improve documentation of tree manipulation API
    + Update xml2-config man page
    + Consolidate man pages
    + Rename xmlcatalog_man.xml
    + Make examples a standalone HTML page
    + Fix documentation in entities.c
    + Add note about optimization flags</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661428800">- Update to version 2.10.1:
  * Regressions: Fix xmlCtxtReadDoc with encoding
  * Bug fixes: Fix HTML parser with threads and --without-legacy
  * Build system:
    + Fix build with Python 3.10
    + cmake: Disable version script on macOS
    + Remove Makefile rule to build testapi.c
  * Documentation:
    + Switch back to HTML output for API documentation
    + Port doc/examples/index.py to Python 3
    + Fix order of exports in libxml2-api.xml
    + Remove libxml2-refs.xml</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661860800">- Update to version 2.10.2:
  * Improvements:
    + Remove set-but-unused variable in xmlXPathScanName
    + Silence -Warray-bounds warning
  * Build system
    + build: require automake-1.16.3 or later
    + Remove generated files from distribution
  * Test suite: Don't create missing.xml when running testapi
- Add configure --with-python=%{__python3} inbefore python build,
  as upstream no longer ships pre-grenerated files.
- Use sed to fix env-script-interpreter in documentation example.
- Pass with-ftp to configure, build ftp support.</changelog>
  <changelog author="pmonreal@suse.com" date="1662033600">- Build for now with --with-legacy to enable APIs that have been
  deprecated recently. (bsc#1202965)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1665748800">- Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304):
  + Security:
  - [CVE-2022-40304] Fix dict corruption caused by entity
    reference cycles
  - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE
  - Fix overflow check in SAX2.c
  + Build system: cmake: Set SOVERSION
- Rebase patches with quilt.</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
  <changelog author="daniel.garcia@suse.com" date="1681905600">- Build also for modern python version (jsc#PED-68)</changelog>
  <changelog author="david.anes@suse.com" date="1682078400">- Remove unneeded dependency (bsc#1209918).</changelog>
  <changelog author="david.anes@suse.com" date="1682078401">- Security update:
  * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings
    isn't deterministic
  - Added patch libxml2-CVE-2023-29469.patch
  * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in
    xmlSchemaFixupComplexType
  - Added patch libxml2-CVE-2023-28484-1.patch
  - Added patch libxml2-CVE-2023-28484-2.patch</changelog>
  <changelog author="david.anes@suse.com" date="1693828800">- Security update:
  * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global
    buffer overflow
  - Added file libxml2-CVE-2023-39615.patch</changelog>
</package>
<package pkgid="70facfd37535d56a8e679991d4fe67aa121c021e141a7caa6917552267128cbe" name="libxml2-2" arch="x86_64">
  <version epoch="0" ver="2.10.3" rel="150500.5.8.1"/>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1622548800">- Update to version 2.9.12
  * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879),
    CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595,
    CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928)
  * Fix null deref in legacy SAX1 parser
  * Fix handling of unexpected EOF in xmlParseContent
  * Fix user-after-free
  * Validate UTF8 in xmlEncodeEntities
  * Fix memory leak in xmlParseElementMixedContentDecl
  * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin
  * Fix SEGV in xmlSAXParseFileWithData
  * Don't process siblings of root in xmlXIncludeProcess
  * Full changes: http://xmlsoft.org/news.html
- Drop upstream fixed
  * libxml2-CVE-2021-3541.patch
  * libxml2-CVE-2021-3537.patch
  * libxml2-CVE-2021-3518.patch
  * libxml2-CVE-2021-3517.patch
  * libxml2-CVE-2021-3516.patch
  * libxml2-CVE-2020-7595.patch
  * libxml2-CVE-2019-20388.patch
  * libxml2-CVE-2020-24977.patch
  * libxml2-CVE-2019-19956.patch
  * libxml2-python39.patch
  * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch
- Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch
- Drop since 2.8.0 merged fix-perl.diff
- Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Fix python-lxml regression with libxml2 2.9.12:
  * Work around lxml API abuse:
    gitlab.gnome.org/GNOME/libxml2/issues/255
- Add upstream patches:
  * libxml2-fix-lxml-corrupted-subtree-structures.patch
  * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch</changelog>
  <changelog author="mcepl@suse.com" date="1634731200">- Rewrite package to the single-spec %python_subpackage_only style and
  eliminate unnecessary multibuild.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1646740800">- Update to version 2.9.13:
  * Security fixes:
    + [CVE-2022-23308] Use-after-free of ID and IDREF attributes
    (boo#1196490);
    + Several memory leaks and another issues.
  * Many regressions fixes.
  * Numerous bug fixes, including, among many others:
    + xmllint's --maxmem option should work as expected now;
    + xmllint now returns an error if arguments are missing.
  * Numerous tests and code and fuzzing fixes and improvements.
  * Updated documentation.
- The full Libxml2 2.9.13 NEWS can be found here:
  https://download.gnome.org/sources/libxml2/2.9/\
  libxml2-2.9.13.news.
- Replace version-release macros in all 3 Obsoletes tag with
  plain 2.9.13 to avoid unwanted behaviors in the future.
- Remove dropped upstream AUTHORS file from list of files to be
  installed in the documentation location with 'cp' command.
- Update http://xmlsoft.org URL tag to Libxml2's new web home:
  https://gitlab.gnome.org/GNOME/libxml2.
- Update ftp://xmlsoft.org Source tag to Libxml2's new download
  host: https://download.gnome.org.
- Drop deprecated Python-2-related macro definitions/conditional
  statement from spec file.
- Drop merged upstream patches:
  libxml2-fix-lxml-corrupted-subtree-structures.patch;
  libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch.
- Drop libxml2.keyring source file as the new download host doesn't
  offer GPG signatures.
- Use ldconfig_scriptlets macro for post(un) handling.</changelog>
  <changelog author="dimstar@opensuse.org" date="1647604800">- Build python bindings in a 2nd run, using multibuild: otherwise,
  libxml2 requires pkgconfig(libxml-2.0) to build, causing issues
  to bootstrap.</changelog>
  <changelog author="david.anes@suse.com" date="1651492800">- Update to 2.9.14:
  * Security:
    + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
    + Fix potential double-free in xmlXPtrStringRangeFunction
    + Fix memory leak in xmlFindCharEncodingHandler
    + Normalize XPath strings in-place
    + Prevent integer-overflow in htmlSkipBlankChars() and
    xmlSkipBlankChars()
    + Fix leak of xmlElementContent
  * Bug fixes:
    + Fix parsing of subtracted regex character classes
    + Fix recursion check in xinclude.c
    + Reset last error in xmlCleanupGlobals
    + Fix certain combinations of regex range quantifiers
    + Fix range quantifier on subregex
  * Improvements:
    + Fix recovery from invalid HTML start tags
  * Build system, portability:
    + Define LFS macros before including system headers
    + Initialize XPath floating-point globals
    + configure: check for icu DEFS
    + configure.ac: produce tar.xz only (GNOME policy)
    + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
    + Fix build with older Python versions
    + Fix --without-valid build</changelog>
  <changelog author="david.anes@suse.com" date="1660824000">- Update to 2.10.0:
  * Security
    + [CVE-2022-2309] Reset nsNr in xmlCtxtReset
    + Reserve byte for NUL terminator and report errors consistently in xmlBuf and
    xmlBuffer
    + Fix missing NUL terminators in xmlBuf and xmlBuffer functions
    + Fix integer overflow in xmlBufferDump()
    + xmlBufAvail() should return length without including a byte for NUL
    terminator
    + Fix ownership of xmlNodePtr &amp; xmlAttrPtr fields in xmlSetTreeDoc()
    + Use xmlNewDocText in xmlXIncludeCopyRange
    + Fix use-after-free bugs when calling xmlTextReaderClose() before
    xmlFreeTextReader() on post-validating parser
    + Use UPDATE_COMPAT() consistently in buf.c
    + fix: xmlXPathParserContext could be double-delete in  OOM case.
  * Removals and deprecations
    + Disable XPointer location support by default
    + Remove outdated xml2Conf.sh
    + Deprecate module init and cleanup functions
    + Remove obsolete XML Software Autoupdate (XSA) file
    + Remove DOCBparser
    + Remove obsolete Python test framework
    + Remove broken VxWorks support
    + Remove broken Mac OS 9 support
    + Remove broken bakefile support
    + Remove broken Visual Studio 2010 support
    + Remove broken Windows CE support
    + Deprecate IDREF-related functions in valid.h
    + Deprecate legacy functions
    + Disable legacy support by default
    + Deprecate all functions in nanoftp.h
    + Disable FTP support by default
    + Add XML_DEPRECATED macro
    + Remove elfgcchack.h
  * Regressions
    + Skip incorrectly opened HTML comments
    + Restore behavior of htmlDocContentDumpFormatOutput()
  * Bug fixes
    + Fix memory leak with invalid XSD
    + Make XPath depth check work with recursive invocations
    + Fix memory leak in xmlLoadEntityContent error path
    + Avoid double-free if malloc fails in inputPush
    + Properly fold whitespace around the QName value when validating an XSD
    schema.
    + Add whitespace folding for some atomic data types that it's missing on.
    + Don't add IDs containing unexpanded entity references
  * Improvements
    + Avoid calling xmlSetTreeDoc
    + Simplify xmlFreeNode
    + Don't reset nsDef when changing node content
    + Fix unintended fall-through in xmlNodeAddContentLen
    + Remove unused xmlBuf functions
    + Implement xpath1() XPointer scheme
    + Add configuration flag for XPointer locations support
    + Fix compiler warnings in Python code
    + Mark more static data as `const`
    + Make xmlStaticCopyNode non-recursive
    + Clean up encoding switching code
    + Simplify recursive pthread mutex
    + Use non-recursive mutex in dict.c
    + Fix parser progress checks
    + Avoid arithmetic on freed pointers
    + Improve buffer allocation scheme
    + Remove unneeded #includes
    + Add support for some non-standard escapes in regular expressions.
    + htmlParseComment: handle abruptly-closed comments
    + Add let variable tag support
    + Add value-of tag support
    + Remove useless call to xmlRelaxNGCleanupTypes
    + Don't include ICU headers in public headers
    + Update `xmlStrlen()` to use POSIX / ISO C `strlen()`
    + Fix unused variable warnings with disabled features
    + Only warn on invalid redeclarations of predefined entities
    + Remove unneeded code in xmlreader.c
    + Rework validation context flags
  * Portability
    + Use NAN/INFINITY if available to init XPath NaN/Inf
    + Fix Python tests on macOS
    + Fix xmlCleanupThreads on Windows
    + Fix reinitialization of library on Windows
    + Don't mix declarations and code in runtest.c
    + Use portable python shebangs
    + Use critical sections as mutex on Windows
    + Don't set HAVE_WIN32_THREADS in win32config.h
    + Use stdint.h with newer MSVC
    + Remove cruft from win32config.h
    + Remove isinf/isnan emulation in win32config.h
    + Always fopen files with "rb"
    + Remove __DJGPP__ checks
    + Remove useless __CYGWIN__ checks
  * Build system
    + Don't autogenerate doc/examples/Makefile.am
    + cmake: Install libxml.m4 on UNIX-like platforms
    + cmake: Use symbol versioning on UNIX-like platforms
    + Port genUnicode.py to Python 3
    + Port gentest.py to Python 3
    + cmake: Fix build without thread support
    + cmake: Install documentation in CMAKE_INSTALL_DOCDIR
    + cmake: Remove non needed files in docs dir
    + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set
    + Move local Autoconf macros into m4 directory
    + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD
    + Update libxml-2.0-uninstalled.pc.in
    + Remove LIBS from XML_PRIVATE_LIBS
    + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS
    + Don't overlink executables
    + cmake: Adjust paths for UNIX or UNIX-like target systems
    + build: Make use of variables in libxml's pkg-config file
    + Avoid obsolescent `test -a` constructs
    + Move AM_MAINTAINER_MODE to AM section
    + configure.ac: make AM_SILENT_RULES([yes]) unconditional
    + Streamline documentation installation
    + Don't try to recreate COPYING symlink
    + Detect libm using libtool's macros
    + configure.ac: disable static libraries by default
    + python/Makefile.am: nest python docs in $(docdir)
    + python/Makefile.am: rely on global AM_INIT_AUTOMAKE
    + Makefile.am: install examples more idiomatically
    + configure.ac: remove useless AC_SUBST
    + Respect `--sysconfdir` in source files
    + Ignore configure backup file created by recent autoreconf too
    + Only install *.html and *.c example files
    + Remove --with-html-dir option
    + Rework documentation build system
    + Remove old website
    + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings
    + Update genChRanges.py
    + Update build_glob.py
    + Remove ICONV_CONST test
    + Remove obsolete AC_HEADER checks
    + Don't check for standard C89 library functions
    + Don't check for standard C89 headers
    + Remove special configuration for certain maintainers
  * Test suite, CI
    + Disable network in API tests
    + testapi: remove leading slash from "/missing.xml"
    + Build Autotools CI tests out of source tree (VPATH)
    + Add --with-minimum build to CI tests
    + Fix warnings when testing --with-minimum build
    + cmake: Run all tests when threads are disabled
    + Also build CI tests with -Werror
    + Move doc/examples tests to new test suite
    + Simplify 'make check' targets
    + Fix schemas and relaxng tests
    + Remove unused result files
    + Allow missing result files in runtest
    + Move regexp tests to runtest
    + Move SVG tests to runtest.c
    + Move testModule to new test suite
    + Move testThreads to new test suite
    + Remove major parts of old test suite
    + Make testchar return an error on failure
    + Add CI job for static build
    + python/tests: open() relative to test scripts
    + Port some test scripts to Python 3
  * Documentation
    + Improve documentation of tree manipulation API
    + Update xml2-config man page
    + Consolidate man pages
    + Rename xmlcatalog_man.xml
    + Make examples a standalone HTML page
    + Fix documentation in entities.c
    + Add note about optimization flags</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661428800">- Update to version 2.10.1:
  * Regressions: Fix xmlCtxtReadDoc with encoding
  * Bug fixes: Fix HTML parser with threads and --without-legacy
  * Build system:
    + Fix build with Python 3.10
    + cmake: Disable version script on macOS
    + Remove Makefile rule to build testapi.c
  * Documentation:
    + Switch back to HTML output for API documentation
    + Port doc/examples/index.py to Python 3
    + Fix order of exports in libxml2-api.xml
    + Remove libxml2-refs.xml</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661860800">- Update to version 2.10.2:
  * Improvements:
    + Remove set-but-unused variable in xmlXPathScanName
    + Silence -Warray-bounds warning
  * Build system
    + build: require automake-1.16.3 or later
    + Remove generated files from distribution
  * Test suite: Don't create missing.xml when running testapi
- Add configure --with-python=%{__python3} inbefore python build,
  as upstream no longer ships pre-grenerated files.
- Use sed to fix env-script-interpreter in documentation example.
- Pass with-ftp to configure, build ftp support.</changelog>
  <changelog author="pmonreal@suse.com" date="1662033600">- Build for now with --with-legacy to enable APIs that have been
  deprecated recently. (bsc#1202965)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1665748800">- Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304):
  + Security:
  - [CVE-2022-40304] Fix dict corruption caused by entity
    reference cycles
  - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE
  - Fix overflow check in SAX2.c
  + Build system: cmake: Set SOVERSION
- Rebase patches with quilt.</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
  <changelog author="daniel.garcia@suse.com" date="1681905600">- Build also for modern python version (jsc#PED-68)</changelog>
  <changelog author="david.anes@suse.com" date="1682078400">- Remove unneeded dependency (bsc#1209918).</changelog>
  <changelog author="david.anes@suse.com" date="1682078401">- Security update:
  * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings
    isn't deterministic
  - Added patch libxml2-CVE-2023-29469.patch
  * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in
    xmlSchemaFixupComplexType
  - Added patch libxml2-CVE-2023-28484-1.patch
  - Added patch libxml2-CVE-2023-28484-2.patch</changelog>
  <changelog author="david.anes@suse.com" date="1693828800">- Security update:
  * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global
    buffer overflow
  - Added file libxml2-CVE-2023-39615.patch</changelog>
</package>
<package pkgid="ffd8d5656c2b78a95469549b0cc01d61e7d1a63d1206d6cbb45d3082cb3ef213" name="libxml2" arch="src">
  <version epoch="0" ver="2.10.3" rel="150500.5.8.1"/>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1622548800">- Update to version 2.9.12
  * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879),
    CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595,
    CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928)
  * Fix null deref in legacy SAX1 parser
  * Fix handling of unexpected EOF in xmlParseContent
  * Fix user-after-free
  * Validate UTF8 in xmlEncodeEntities
  * Fix memory leak in xmlParseElementMixedContentDecl
  * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin
  * Fix SEGV in xmlSAXParseFileWithData
  * Don't process siblings of root in xmlXIncludeProcess
  * Full changes: http://xmlsoft.org/news.html
- Drop upstream fixed
  * libxml2-CVE-2021-3541.patch
  * libxml2-CVE-2021-3537.patch
  * libxml2-CVE-2021-3518.patch
  * libxml2-CVE-2021-3517.patch
  * libxml2-CVE-2021-3516.patch
  * libxml2-CVE-2020-7595.patch
  * libxml2-CVE-2019-20388.patch
  * libxml2-CVE-2020-24977.patch
  * libxml2-CVE-2019-19956.patch
  * libxml2-python39.patch
  * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch
- Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch
- Drop since 2.8.0 merged fix-perl.diff
- Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Fix python-lxml regression with libxml2 2.9.12:
  * Work around lxml API abuse:
    gitlab.gnome.org/GNOME/libxml2/issues/255
- Add upstream patches:
  * libxml2-fix-lxml-corrupted-subtree-structures.patch
  * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch</changelog>
  <changelog author="mcepl@suse.com" date="1634731200">- Rewrite package to the single-spec %python_subpackage_only style and
  eliminate unnecessary multibuild.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1646740800">- Update to version 2.9.13:
  * Security fixes:
    + [CVE-2022-23308] Use-after-free of ID and IDREF attributes
    (boo#1196490);
    + Several memory leaks and another issues.
  * Many regressions fixes.
  * Numerous bug fixes, including, among many others:
    + xmllint's --maxmem option should work as expected now;
    + xmllint now returns an error if arguments are missing.
  * Numerous tests and code and fuzzing fixes and improvements.
  * Updated documentation.
- The full Libxml2 2.9.13 NEWS can be found here:
  https://download.gnome.org/sources/libxml2/2.9/\
  libxml2-2.9.13.news.
- Replace version-release macros in all 3 Obsoletes tag with
  plain 2.9.13 to avoid unwanted behaviors in the future.
- Remove dropped upstream AUTHORS file from list of files to be
  installed in the documentation location with 'cp' command.
- Update http://xmlsoft.org URL tag to Libxml2's new web home:
  https://gitlab.gnome.org/GNOME/libxml2.
- Update ftp://xmlsoft.org Source tag to Libxml2's new download
  host: https://download.gnome.org.
- Drop deprecated Python-2-related macro definitions/conditional
  statement from spec file.
- Drop merged upstream patches:
  libxml2-fix-lxml-corrupted-subtree-structures.patch;
  libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch.
- Drop libxml2.keyring source file as the new download host doesn't
  offer GPG signatures.
- Use ldconfig_scriptlets macro for post(un) handling.</changelog>
  <changelog author="dimstar@opensuse.org" date="1647604800">- Build python bindings in a 2nd run, using multibuild: otherwise,
  libxml2 requires pkgconfig(libxml-2.0) to build, causing issues
  to bootstrap.</changelog>
  <changelog author="david.anes@suse.com" date="1651492800">- Update to 2.9.14:
  * Security:
    + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
    + Fix potential double-free in xmlXPtrStringRangeFunction
    + Fix memory leak in xmlFindCharEncodingHandler
    + Normalize XPath strings in-place
    + Prevent integer-overflow in htmlSkipBlankChars() and
    xmlSkipBlankChars()
    + Fix leak of xmlElementContent
  * Bug fixes:
    + Fix parsing of subtracted regex character classes
    + Fix recursion check in xinclude.c
    + Reset last error in xmlCleanupGlobals
    + Fix certain combinations of regex range quantifiers
    + Fix range quantifier on subregex
  * Improvements:
    + Fix recovery from invalid HTML start tags
  * Build system, portability:
    + Define LFS macros before including system headers
    + Initialize XPath floating-point globals
    + configure: check for icu DEFS
    + configure.ac: produce tar.xz only (GNOME policy)
    + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
    + Fix build with older Python versions
    + Fix --without-valid build</changelog>
  <changelog author="david.anes@suse.com" date="1660824000">- Update to 2.10.0:
  * Security
    + [CVE-2022-2309] Reset nsNr in xmlCtxtReset
    + Reserve byte for NUL terminator and report errors consistently in xmlBuf and
    xmlBuffer
    + Fix missing NUL terminators in xmlBuf and xmlBuffer functions
    + Fix integer overflow in xmlBufferDump()
    + xmlBufAvail() should return length without including a byte for NUL
    terminator
    + Fix ownership of xmlNodePtr &amp; xmlAttrPtr fields in xmlSetTreeDoc()
    + Use xmlNewDocText in xmlXIncludeCopyRange
    + Fix use-after-free bugs when calling xmlTextReaderClose() before
    xmlFreeTextReader() on post-validating parser
    + Use UPDATE_COMPAT() consistently in buf.c
    + fix: xmlXPathParserContext could be double-delete in  OOM case.
  * Removals and deprecations
    + Disable XPointer location support by default
    + Remove outdated xml2Conf.sh
    + Deprecate module init and cleanup functions
    + Remove obsolete XML Software Autoupdate (XSA) file
    + Remove DOCBparser
    + Remove obsolete Python test framework
    + Remove broken VxWorks support
    + Remove broken Mac OS 9 support
    + Remove broken bakefile support
    + Remove broken Visual Studio 2010 support
    + Remove broken Windows CE support
    + Deprecate IDREF-related functions in valid.h
    + Deprecate legacy functions
    + Disable legacy support by default
    + Deprecate all functions in nanoftp.h
    + Disable FTP support by default
    + Add XML_DEPRECATED macro
    + Remove elfgcchack.h
  * Regressions
    + Skip incorrectly opened HTML comments
    + Restore behavior of htmlDocContentDumpFormatOutput()
  * Bug fixes
    + Fix memory leak with invalid XSD
    + Make XPath depth check work with recursive invocations
    + Fix memory leak in xmlLoadEntityContent error path
    + Avoid double-free if malloc fails in inputPush
    + Properly fold whitespace around the QName value when validating an XSD
    schema.
    + Add whitespace folding for some atomic data types that it's missing on.
    + Don't add IDs containing unexpanded entity references
  * Improvements
    + Avoid calling xmlSetTreeDoc
    + Simplify xmlFreeNode
    + Don't reset nsDef when changing node content
    + Fix unintended fall-through in xmlNodeAddContentLen
    + Remove unused xmlBuf functions
    + Implement xpath1() XPointer scheme
    + Add configuration flag for XPointer locations support
    + Fix compiler warnings in Python code
    + Mark more static data as `const`
    + Make xmlStaticCopyNode non-recursive
    + Clean up encoding switching code
    + Simplify recursive pthread mutex
    + Use non-recursive mutex in dict.c
    + Fix parser progress checks
    + Avoid arithmetic on freed pointers
    + Improve buffer allocation scheme
    + Remove unneeded #includes
    + Add support for some non-standard escapes in regular expressions.
    + htmlParseComment: handle abruptly-closed comments
    + Add let variable tag support
    + Add value-of tag support
    + Remove useless call to xmlRelaxNGCleanupTypes
    + Don't include ICU headers in public headers
    + Update `xmlStrlen()` to use POSIX / ISO C `strlen()`
    + Fix unused variable warnings with disabled features
    + Only warn on invalid redeclarations of predefined entities
    + Remove unneeded code in xmlreader.c
    + Rework validation context flags
  * Portability
    + Use NAN/INFINITY if available to init XPath NaN/Inf
    + Fix Python tests on macOS
    + Fix xmlCleanupThreads on Windows
    + Fix reinitialization of library on Windows
    + Don't mix declarations and code in runtest.c
    + Use portable python shebangs
    + Use critical sections as mutex on Windows
    + Don't set HAVE_WIN32_THREADS in win32config.h
    + Use stdint.h with newer MSVC
    + Remove cruft from win32config.h
    + Remove isinf/isnan emulation in win32config.h
    + Always fopen files with "rb"
    + Remove __DJGPP__ checks
    + Remove useless __CYGWIN__ checks
  * Build system
    + Don't autogenerate doc/examples/Makefile.am
    + cmake: Install libxml.m4 on UNIX-like platforms
    + cmake: Use symbol versioning on UNIX-like platforms
    + Port genUnicode.py to Python 3
    + Port gentest.py to Python 3
    + cmake: Fix build without thread support
    + cmake: Install documentation in CMAKE_INSTALL_DOCDIR
    + cmake: Remove non needed files in docs dir
    + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set
    + Move local Autoconf macros into m4 directory
    + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD
    + Update libxml-2.0-uninstalled.pc.in
    + Remove LIBS from XML_PRIVATE_LIBS
    + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS
    + Don't overlink executables
    + cmake: Adjust paths for UNIX or UNIX-like target systems
    + build: Make use of variables in libxml's pkg-config file
    + Avoid obsolescent `test -a` constructs
    + Move AM_MAINTAINER_MODE to AM section
    + configure.ac: make AM_SILENT_RULES([yes]) unconditional
    + Streamline documentation installation
    + Don't try to recreate COPYING symlink
    + Detect libm using libtool's macros
    + configure.ac: disable static libraries by default
    + python/Makefile.am: nest python docs in $(docdir)
    + python/Makefile.am: rely on global AM_INIT_AUTOMAKE
    + Makefile.am: install examples more idiomatically
    + configure.ac: remove useless AC_SUBST
    + Respect `--sysconfdir` in source files
    + Ignore configure backup file created by recent autoreconf too
    + Only install *.html and *.c example files
    + Remove --with-html-dir option
    + Rework documentation build system
    + Remove old website
    + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings
    + Update genChRanges.py
    + Update build_glob.py
    + Remove ICONV_CONST test
    + Remove obsolete AC_HEADER checks
    + Don't check for standard C89 library functions
    + Don't check for standard C89 headers
    + Remove special configuration for certain maintainers
  * Test suite, CI
    + Disable network in API tests
    + testapi: remove leading slash from "/missing.xml"
    + Build Autotools CI tests out of source tree (VPATH)
    + Add --with-minimum build to CI tests
    + Fix warnings when testing --with-minimum build
    + cmake: Run all tests when threads are disabled
    + Also build CI tests with -Werror
    + Move doc/examples tests to new test suite
    + Simplify 'make check' targets
    + Fix schemas and relaxng tests
    + Remove unused result files
    + Allow missing result files in runtest
    + Move regexp tests to runtest
    + Move SVG tests to runtest.c
    + Move testModule to new test suite
    + Move testThreads to new test suite
    + Remove major parts of old test suite
    + Make testchar return an error on failure
    + Add CI job for static build
    + python/tests: open() relative to test scripts
    + Port some test scripts to Python 3
  * Documentation
    + Improve documentation of tree manipulation API
    + Update xml2-config man page
    + Consolidate man pages
    + Rename xmlcatalog_man.xml
    + Make examples a standalone HTML page
    + Fix documentation in entities.c
    + Add note about optimization flags</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661428800">- Update to version 2.10.1:
  * Regressions: Fix xmlCtxtReadDoc with encoding
  * Bug fixes: Fix HTML parser with threads and --without-legacy
  * Build system:
    + Fix build with Python 3.10
    + cmake: Disable version script on macOS
    + Remove Makefile rule to build testapi.c
  * Documentation:
    + Switch back to HTML output for API documentation
    + Port doc/examples/index.py to Python 3
    + Fix order of exports in libxml2-api.xml
    + Remove libxml2-refs.xml</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661860800">- Update to version 2.10.2:
  * Improvements:
    + Remove set-but-unused variable in xmlXPathScanName
    + Silence -Warray-bounds warning
  * Build system
    + build: require automake-1.16.3 or later
    + Remove generated files from distribution
  * Test suite: Don't create missing.xml when running testapi
- Add configure --with-python=%{__python3} inbefore python build,
  as upstream no longer ships pre-grenerated files.
- Use sed to fix env-script-interpreter in documentation example.
- Pass with-ftp to configure, build ftp support.</changelog>
  <changelog author="pmonreal@suse.com" date="1662033600">- Build for now with --with-legacy to enable APIs that have been
  deprecated recently. (bsc#1202965)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1665748800">- Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304):
  + Security:
  - [CVE-2022-40304] Fix dict corruption caused by entity
    reference cycles
  - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE
  - Fix overflow check in SAX2.c
  + Build system: cmake: Set SOVERSION
- Rebase patches with quilt.</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
  <changelog author="daniel.garcia@suse.com" date="1681905600">- Build also for modern python version (jsc#PED-68)</changelog>
  <changelog author="david.anes@suse.com" date="1682078400">- Remove unneeded dependency (bsc#1209918).</changelog>
  <changelog author="david.anes@suse.com" date="1682078401">- Security update:
  * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings
    isn't deterministic
  - Added patch libxml2-CVE-2023-29469.patch
  * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in
    xmlSchemaFixupComplexType
  - Added patch libxml2-CVE-2023-28484-1.patch
  - Added patch libxml2-CVE-2023-28484-2.patch</changelog>
  <changelog author="david.anes@suse.com" date="1693828800">- Security update:
  * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global
    buffer overflow
  - Added file libxml2-CVE-2023-39615.patch</changelog>
</package>
<package pkgid="4406294c2f62774b3284d209b7f042376fa688cd98676a0fbfdf8b0916839176" name="libxml2-python" arch="src">
  <version epoch="0" ver="2.10.3" rel="150500.5.8.1"/>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1622548800">- Update to version 2.9.12
  * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879),
    CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595,
    CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928)
  * Fix null deref in legacy SAX1 parser
  * Fix handling of unexpected EOF in xmlParseContent
  * Fix user-after-free
  * Validate UTF8 in xmlEncodeEntities
  * Fix memory leak in xmlParseElementMixedContentDecl
  * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin
  * Fix SEGV in xmlSAXParseFileWithData
  * Don't process siblings of root in xmlXIncludeProcess
  * Full changes: http://xmlsoft.org/news.html
- Drop upstream fixed
  * libxml2-CVE-2021-3541.patch
  * libxml2-CVE-2021-3537.patch
  * libxml2-CVE-2021-3518.patch
  * libxml2-CVE-2021-3517.patch
  * libxml2-CVE-2021-3516.patch
  * libxml2-CVE-2020-7595.patch
  * libxml2-CVE-2019-20388.patch
  * libxml2-CVE-2020-24977.patch
  * libxml2-CVE-2019-19956.patch
  * libxml2-python39.patch
  * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch
- Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch
- Drop since 2.8.0 merged fix-perl.diff
- Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Fix python-lxml regression with libxml2 2.9.12:
  * Work around lxml API abuse:
    gitlab.gnome.org/GNOME/libxml2/issues/255
- Add upstream patches:
  * libxml2-fix-lxml-corrupted-subtree-structures.patch
  * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch</changelog>
  <changelog author="mcepl@suse.com" date="1634731200">- Rewrite package to the single-spec %python_subpackage_only style and
  eliminate unnecessary multibuild.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1646740800">- Update to version 2.9.13:
  * Security fixes:
    + [CVE-2022-23308] Use-after-free of ID and IDREF attributes
    (boo#1196490);
    + Several memory leaks and another issues.
  * Many regressions fixes.
  * Numerous bug fixes, including, among many others:
    + xmllint's --maxmem option should work as expected now;
    + xmllint now returns an error if arguments are missing.
  * Numerous tests and code and fuzzing fixes and improvements.
  * Updated documentation.
- The full Libxml2 2.9.13 NEWS can be found here:
  https://download.gnome.org/sources/libxml2/2.9/\
  libxml2-2.9.13.news.
- Replace version-release macros in all 3 Obsoletes tag with
  plain 2.9.13 to avoid unwanted behaviors in the future.
- Remove dropped upstream AUTHORS file from list of files to be
  installed in the documentation location with 'cp' command.
- Update http://xmlsoft.org URL tag to Libxml2's new web home:
  https://gitlab.gnome.org/GNOME/libxml2.
- Update ftp://xmlsoft.org Source tag to Libxml2's new download
  host: https://download.gnome.org.
- Drop deprecated Python-2-related macro definitions/conditional
  statement from spec file.
- Drop merged upstream patches:
  libxml2-fix-lxml-corrupted-subtree-structures.patch;
  libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch.
- Drop libxml2.keyring source file as the new download host doesn't
  offer GPG signatures.
- Use ldconfig_scriptlets macro for post(un) handling.</changelog>
  <changelog author="dimstar@opensuse.org" date="1647604800">- Build python bindings in a 2nd run, using multibuild: otherwise,
  libxml2 requires pkgconfig(libxml-2.0) to build, causing issues
  to bootstrap.</changelog>
  <changelog author="david.anes@suse.com" date="1651492800">- Update to 2.9.14:
  * Security:
    + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
    + Fix potential double-free in xmlXPtrStringRangeFunction
    + Fix memory leak in xmlFindCharEncodingHandler
    + Normalize XPath strings in-place
    + Prevent integer-overflow in htmlSkipBlankChars() and
    xmlSkipBlankChars()
    + Fix leak of xmlElementContent
  * Bug fixes:
    + Fix parsing of subtracted regex character classes
    + Fix recursion check in xinclude.c
    + Reset last error in xmlCleanupGlobals
    + Fix certain combinations of regex range quantifiers
    + Fix range quantifier on subregex
  * Improvements:
    + Fix recovery from invalid HTML start tags
  * Build system, portability:
    + Define LFS macros before including system headers
    + Initialize XPath floating-point globals
    + configure: check for icu DEFS
    + configure.ac: produce tar.xz only (GNOME policy)
    + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
    + Fix build with older Python versions
    + Fix --without-valid build</changelog>
  <changelog author="david.anes@suse.com" date="1660824000">- Update to 2.10.0:
  * Security
    + [CVE-2022-2309] Reset nsNr in xmlCtxtReset
    + Reserve byte for NUL terminator and report errors consistently in xmlBuf and
    xmlBuffer
    + Fix missing NUL terminators in xmlBuf and xmlBuffer functions
    + Fix integer overflow in xmlBufferDump()
    + xmlBufAvail() should return length without including a byte for NUL
    terminator
    + Fix ownership of xmlNodePtr &amp; xmlAttrPtr fields in xmlSetTreeDoc()
    + Use xmlNewDocText in xmlXIncludeCopyRange
    + Fix use-after-free bugs when calling xmlTextReaderClose() before
    xmlFreeTextReader() on post-validating parser
    + Use UPDATE_COMPAT() consistently in buf.c
    + fix: xmlXPathParserContext could be double-delete in  OOM case.
  * Removals and deprecations
    + Disable XPointer location support by default
    + Remove outdated xml2Conf.sh
    + Deprecate module init and cleanup functions
    + Remove obsolete XML Software Autoupdate (XSA) file
    + Remove DOCBparser
    + Remove obsolete Python test framework
    + Remove broken VxWorks support
    + Remove broken Mac OS 9 support
    + Remove broken bakefile support
    + Remove broken Visual Studio 2010 support
    + Remove broken Windows CE support
    + Deprecate IDREF-related functions in valid.h
    + Deprecate legacy functions
    + Disable legacy support by default
    + Deprecate all functions in nanoftp.h
    + Disable FTP support by default
    + Add XML_DEPRECATED macro
    + Remove elfgcchack.h
  * Regressions
    + Skip incorrectly opened HTML comments
    + Restore behavior of htmlDocContentDumpFormatOutput()
  * Bug fixes
    + Fix memory leak with invalid XSD
    + Make XPath depth check work with recursive invocations
    + Fix memory leak in xmlLoadEntityContent error path
    + Avoid double-free if malloc fails in inputPush
    + Properly fold whitespace around the QName value when validating an XSD
    schema.
    + Add whitespace folding for some atomic data types that it's missing on.
    + Don't add IDs containing unexpanded entity references
  * Improvements
    + Avoid calling xmlSetTreeDoc
    + Simplify xmlFreeNode
    + Don't reset nsDef when changing node content
    + Fix unintended fall-through in xmlNodeAddContentLen
    + Remove unused xmlBuf functions
    + Implement xpath1() XPointer scheme
    + Add configuration flag for XPointer locations support
    + Fix compiler warnings in Python code
    + Mark more static data as `const`
    + Make xmlStaticCopyNode non-recursive
    + Clean up encoding switching code
    + Simplify recursive pthread mutex
    + Use non-recursive mutex in dict.c
    + Fix parser progress checks
    + Avoid arithmetic on freed pointers
    + Improve buffer allocation scheme
    + Remove unneeded #includes
    + Add support for some non-standard escapes in regular expressions.
    + htmlParseComment: handle abruptly-closed comments
    + Add let variable tag support
    + Add value-of tag support
    + Remove useless call to xmlRelaxNGCleanupTypes
    + Don't include ICU headers in public headers
    + Update `xmlStrlen()` to use POSIX / ISO C `strlen()`
    + Fix unused variable warnings with disabled features
    + Only warn on invalid redeclarations of predefined entities
    + Remove unneeded code in xmlreader.c
    + Rework validation context flags
  * Portability
    + Use NAN/INFINITY if available to init XPath NaN/Inf
    + Fix Python tests on macOS
    + Fix xmlCleanupThreads on Windows
    + Fix reinitialization of library on Windows
    + Don't mix declarations and code in runtest.c
    + Use portable python shebangs
    + Use critical sections as mutex on Windows
    + Don't set HAVE_WIN32_THREADS in win32config.h
    + Use stdint.h with newer MSVC
    + Remove cruft from win32config.h
    + Remove isinf/isnan emulation in win32config.h
    + Always fopen files with "rb"
    + Remove __DJGPP__ checks
    + Remove useless __CYGWIN__ checks
  * Build system
    + Don't autogenerate doc/examples/Makefile.am
    + cmake: Install libxml.m4 on UNIX-like platforms
    + cmake: Use symbol versioning on UNIX-like platforms
    + Port genUnicode.py to Python 3
    + Port gentest.py to Python 3
    + cmake: Fix build without thread support
    + cmake: Install documentation in CMAKE_INSTALL_DOCDIR
    + cmake: Remove non needed files in docs dir
    + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set
    + Move local Autoconf macros into m4 directory
    + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD
    + Update libxml-2.0-uninstalled.pc.in
    + Remove LIBS from XML_PRIVATE_LIBS
    + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS
    + Don't overlink executables
    + cmake: Adjust paths for UNIX or UNIX-like target systems
    + build: Make use of variables in libxml's pkg-config file
    + Avoid obsolescent `test -a` constructs
    + Move AM_MAINTAINER_MODE to AM section
    + configure.ac: make AM_SILENT_RULES([yes]) unconditional
    + Streamline documentation installation
    + Don't try to recreate COPYING symlink
    + Detect libm using libtool's macros
    + configure.ac: disable static libraries by default
    + python/Makefile.am: nest python docs in $(docdir)
    + python/Makefile.am: rely on global AM_INIT_AUTOMAKE
    + Makefile.am: install examples more idiomatically
    + configure.ac: remove useless AC_SUBST
    + Respect `--sysconfdir` in source files
    + Ignore configure backup file created by recent autoreconf too
    + Only install *.html and *.c example files
    + Remove --with-html-dir option
    + Rework documentation build system
    + Remove old website
    + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings
    + Update genChRanges.py
    + Update build_glob.py
    + Remove ICONV_CONST test
    + Remove obsolete AC_HEADER checks
    + Don't check for standard C89 library functions
    + Don't check for standard C89 headers
    + Remove special configuration for certain maintainers
  * Test suite, CI
    + Disable network in API tests
    + testapi: remove leading slash from "/missing.xml"
    + Build Autotools CI tests out of source tree (VPATH)
    + Add --with-minimum build to CI tests
    + Fix warnings when testing --with-minimum build
    + cmake: Run all tests when threads are disabled
    + Also build CI tests with -Werror
    + Move doc/examples tests to new test suite
    + Simplify 'make check' targets
    + Fix schemas and relaxng tests
    + Remove unused result files
    + Allow missing result files in runtest
    + Move regexp tests to runtest
    + Move SVG tests to runtest.c
    + Move testModule to new test suite
    + Move testThreads to new test suite
    + Remove major parts of old test suite
    + Make testchar return an error on failure
    + Add CI job for static build
    + python/tests: open() relative to test scripts
    + Port some test scripts to Python 3
  * Documentation
    + Improve documentation of tree manipulation API
    + Update xml2-config man page
    + Consolidate man pages
    + Rename xmlcatalog_man.xml
    + Make examples a standalone HTML page
    + Fix documentation in entities.c
    + Add note about optimization flags</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661428800">- Update to version 2.10.1:
  * Regressions: Fix xmlCtxtReadDoc with encoding
  * Bug fixes: Fix HTML parser with threads and --without-legacy
  * Build system:
    + Fix build with Python 3.10
    + cmake: Disable version script on macOS
    + Remove Makefile rule to build testapi.c
  * Documentation:
    + Switch back to HTML output for API documentation
    + Port doc/examples/index.py to Python 3
    + Fix order of exports in libxml2-api.xml
    + Remove libxml2-refs.xml</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661860800">- Update to version 2.10.2:
  * Improvements:
    + Remove set-but-unused variable in xmlXPathScanName
    + Silence -Warray-bounds warning
  * Build system
    + build: require automake-1.16.3 or later
    + Remove generated files from distribution
  * Test suite: Don't create missing.xml when running testapi
- Add configure --with-python=%{__python3} inbefore python build,
  as upstream no longer ships pre-grenerated files.
- Use sed to fix env-script-interpreter in documentation example.
- Pass with-ftp to configure, build ftp support.</changelog>
  <changelog author="pmonreal@suse.com" date="1662033600">- Build for now with --with-legacy to enable APIs that have been
  deprecated recently. (bsc#1202965)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1665748800">- Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304):
  + Security:
  - [CVE-2022-40304] Fix dict corruption caused by entity
    reference cycles
  - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE
  - Fix overflow check in SAX2.c
  + Build system: cmake: Set SOVERSION
- Rebase patches with quilt.</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
  <changelog author="daniel.garcia@suse.com" date="1681905600">- Build also for modern python version (jsc#PED-68)</changelog>
  <changelog author="david.anes@suse.com" date="1682078400">- Remove unneeded dependency (bsc#1209918).</changelog>
  <changelog author="david.anes@suse.com" date="1682078401">- Security update:
  * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings
    isn't deterministic
  - Added patch libxml2-CVE-2023-29469.patch
  * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in
    xmlSchemaFixupComplexType
  - Added patch libxml2-CVE-2023-28484-1.patch
  - Added patch libxml2-CVE-2023-28484-2.patch</changelog>
  <changelog author="david.anes@suse.com" date="1693828800">- Security update:
  * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global
    buffer overflow
  - Added file libxml2-CVE-2023-39615.patch</changelog>
</package>
<package pkgid="23947581059509d63efdc0b4d02cea96b7138df001da75975851808d2fa3feb9" name="libxml2-tools" arch="aarch64">
  <version epoch="0" ver="2.10.3" rel="150500.5.8.1"/>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1622548800">- Update to version 2.9.12
  * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879),
    CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595,
    CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928)
  * Fix null deref in legacy SAX1 parser
  * Fix handling of unexpected EOF in xmlParseContent
  * Fix user-after-free
  * Validate UTF8 in xmlEncodeEntities
  * Fix memory leak in xmlParseElementMixedContentDecl
  * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin
  * Fix SEGV in xmlSAXParseFileWithData
  * Don't process siblings of root in xmlXIncludeProcess
  * Full changes: http://xmlsoft.org/news.html
- Drop upstream fixed
  * libxml2-CVE-2021-3541.patch
  * libxml2-CVE-2021-3537.patch
  * libxml2-CVE-2021-3518.patch
  * libxml2-CVE-2021-3517.patch
  * libxml2-CVE-2021-3516.patch
  * libxml2-CVE-2020-7595.patch
  * libxml2-CVE-2019-20388.patch
  * libxml2-CVE-2020-24977.patch
  * libxml2-CVE-2019-19956.patch
  * libxml2-python39.patch
  * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch
- Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch
- Drop since 2.8.0 merged fix-perl.diff
- Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Fix python-lxml regression with libxml2 2.9.12:
  * Work around lxml API abuse:
    gitlab.gnome.org/GNOME/libxml2/issues/255
- Add upstream patches:
  * libxml2-fix-lxml-corrupted-subtree-structures.patch
  * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch</changelog>
  <changelog author="mcepl@suse.com" date="1634731200">- Rewrite package to the single-spec %python_subpackage_only style and
  eliminate unnecessary multibuild.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1646740800">- Update to version 2.9.13:
  * Security fixes:
    + [CVE-2022-23308] Use-after-free of ID and IDREF attributes
    (boo#1196490);
    + Several memory leaks and another issues.
  * Many regressions fixes.
  * Numerous bug fixes, including, among many others:
    + xmllint's --maxmem option should work as expected now;
    + xmllint now returns an error if arguments are missing.
  * Numerous tests and code and fuzzing fixes and improvements.
  * Updated documentation.
- The full Libxml2 2.9.13 NEWS can be found here:
  https://download.gnome.org/sources/libxml2/2.9/\
  libxml2-2.9.13.news.
- Replace version-release macros in all 3 Obsoletes tag with
  plain 2.9.13 to avoid unwanted behaviors in the future.
- Remove dropped upstream AUTHORS file from list of files to be
  installed in the documentation location with 'cp' command.
- Update http://xmlsoft.org URL tag to Libxml2's new web home:
  https://gitlab.gnome.org/GNOME/libxml2.
- Update ftp://xmlsoft.org Source tag to Libxml2's new download
  host: https://download.gnome.org.
- Drop deprecated Python-2-related macro definitions/conditional
  statement from spec file.
- Drop merged upstream patches:
  libxml2-fix-lxml-corrupted-subtree-structures.patch;
  libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch.
- Drop libxml2.keyring source file as the new download host doesn't
  offer GPG signatures.
- Use ldconfig_scriptlets macro for post(un) handling.</changelog>
  <changelog author="dimstar@opensuse.org" date="1647604800">- Build python bindings in a 2nd run, using multibuild: otherwise,
  libxml2 requires pkgconfig(libxml-2.0) to build, causing issues
  to bootstrap.</changelog>
  <changelog author="david.anes@suse.com" date="1651492800">- Update to 2.9.14:
  * Security:
    + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
    + Fix potential double-free in xmlXPtrStringRangeFunction
    + Fix memory leak in xmlFindCharEncodingHandler
    + Normalize XPath strings in-place
    + Prevent integer-overflow in htmlSkipBlankChars() and
    xmlSkipBlankChars()
    + Fix leak of xmlElementContent
  * Bug fixes:
    + Fix parsing of subtracted regex character classes
    + Fix recursion check in xinclude.c
    + Reset last error in xmlCleanupGlobals
    + Fix certain combinations of regex range quantifiers
    + Fix range quantifier on subregex
  * Improvements:
    + Fix recovery from invalid HTML start tags
  * Build system, portability:
    + Define LFS macros before including system headers
    + Initialize XPath floating-point globals
    + configure: check for icu DEFS
    + configure.ac: produce tar.xz only (GNOME policy)
    + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
    + Fix build with older Python versions
    + Fix --without-valid build</changelog>
  <changelog author="david.anes@suse.com" date="1660824000">- Update to 2.10.0:
  * Security
    + [CVE-2022-2309] Reset nsNr in xmlCtxtReset
    + Reserve byte for NUL terminator and report errors consistently in xmlBuf and
    xmlBuffer
    + Fix missing NUL terminators in xmlBuf and xmlBuffer functions
    + Fix integer overflow in xmlBufferDump()
    + xmlBufAvail() should return length without including a byte for NUL
    terminator
    + Fix ownership of xmlNodePtr &amp; xmlAttrPtr fields in xmlSetTreeDoc()
    + Use xmlNewDocText in xmlXIncludeCopyRange
    + Fix use-after-free bugs when calling xmlTextReaderClose() before
    xmlFreeTextReader() on post-validating parser
    + Use UPDATE_COMPAT() consistently in buf.c
    + fix: xmlXPathParserContext could be double-delete in  OOM case.
  * Removals and deprecations
    + Disable XPointer location support by default
    + Remove outdated xml2Conf.sh
    + Deprecate module init and cleanup functions
    + Remove obsolete XML Software Autoupdate (XSA) file
    + Remove DOCBparser
    + Remove obsolete Python test framework
    + Remove broken VxWorks support
    + Remove broken Mac OS 9 support
    + Remove broken bakefile support
    + Remove broken Visual Studio 2010 support
    + Remove broken Windows CE support
    + Deprecate IDREF-related functions in valid.h
    + Deprecate legacy functions
    + Disable legacy support by default
    + Deprecate all functions in nanoftp.h
    + Disable FTP support by default
    + Add XML_DEPRECATED macro
    + Remove elfgcchack.h
  * Regressions
    + Skip incorrectly opened HTML comments
    + Restore behavior of htmlDocContentDumpFormatOutput()
  * Bug fixes
    + Fix memory leak with invalid XSD
    + Make XPath depth check work with recursive invocations
    + Fix memory leak in xmlLoadEntityContent error path
    + Avoid double-free if malloc fails in inputPush
    + Properly fold whitespace around the QName value when validating an XSD
    schema.
    + Add whitespace folding for some atomic data types that it's missing on.
    + Don't add IDs containing unexpanded entity references
  * Improvements
    + Avoid calling xmlSetTreeDoc
    + Simplify xmlFreeNode
    + Don't reset nsDef when changing node content
    + Fix unintended fall-through in xmlNodeAddContentLen
    + Remove unused xmlBuf functions
    + Implement xpath1() XPointer scheme
    + Add configuration flag for XPointer locations support
    + Fix compiler warnings in Python code
    + Mark more static data as `const`
    + Make xmlStaticCopyNode non-recursive
    + Clean up encoding switching code
    + Simplify recursive pthread mutex
    + Use non-recursive mutex in dict.c
    + Fix parser progress checks
    + Avoid arithmetic on freed pointers
    + Improve buffer allocation scheme
    + Remove unneeded #includes
    + Add support for some non-standard escapes in regular expressions.
    + htmlParseComment: handle abruptly-closed comments
    + Add let variable tag support
    + Add value-of tag support
    + Remove useless call to xmlRelaxNGCleanupTypes
    + Don't include ICU headers in public headers
    + Update `xmlStrlen()` to use POSIX / ISO C `strlen()`
    + Fix unused variable warnings with disabled features
    + Only warn on invalid redeclarations of predefined entities
    + Remove unneeded code in xmlreader.c
    + Rework validation context flags
  * Portability
    + Use NAN/INFINITY if available to init XPath NaN/Inf
    + Fix Python tests on macOS
    + Fix xmlCleanupThreads on Windows
    + Fix reinitialization of library on Windows
    + Don't mix declarations and code in runtest.c
    + Use portable python shebangs
    + Use critical sections as mutex on Windows
    + Don't set HAVE_WIN32_THREADS in win32config.h
    + Use stdint.h with newer MSVC
    + Remove cruft from win32config.h
    + Remove isinf/isnan emulation in win32config.h
    + Always fopen files with "rb"
    + Remove __DJGPP__ checks
    + Remove useless __CYGWIN__ checks
  * Build system
    + Don't autogenerate doc/examples/Makefile.am
    + cmake: Install libxml.m4 on UNIX-like platforms
    + cmake: Use symbol versioning on UNIX-like platforms
    + Port genUnicode.py to Python 3
    + Port gentest.py to Python 3
    + cmake: Fix build without thread support
    + cmake: Install documentation in CMAKE_INSTALL_DOCDIR
    + cmake: Remove non needed files in docs dir
    + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set
    + Move local Autoconf macros into m4 directory
    + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD
    + Update libxml-2.0-uninstalled.pc.in
    + Remove LIBS from XML_PRIVATE_LIBS
    + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS
    + Don't overlink executables
    + cmake: Adjust paths for UNIX or UNIX-like target systems
    + build: Make use of variables in libxml's pkg-config file
    + Avoid obsolescent `test -a` constructs
    + Move AM_MAINTAINER_MODE to AM section
    + configure.ac: make AM_SILENT_RULES([yes]) unconditional
    + Streamline documentation installation
    + Don't try to recreate COPYING symlink
    + Detect libm using libtool's macros
    + configure.ac: disable static libraries by default
    + python/Makefile.am: nest python docs in $(docdir)
    + python/Makefile.am: rely on global AM_INIT_AUTOMAKE
    + Makefile.am: install examples more idiomatically
    + configure.ac: remove useless AC_SUBST
    + Respect `--sysconfdir` in source files
    + Ignore configure backup file created by recent autoreconf too
    + Only install *.html and *.c example files
    + Remove --with-html-dir option
    + Rework documentation build system
    + Remove old website
    + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings
    + Update genChRanges.py
    + Update build_glob.py
    + Remove ICONV_CONST test
    + Remove obsolete AC_HEADER checks
    + Don't check for standard C89 library functions
    + Don't check for standard C89 headers
    + Remove special configuration for certain maintainers
  * Test suite, CI
    + Disable network in API tests
    + testapi: remove leading slash from "/missing.xml"
    + Build Autotools CI tests out of source tree (VPATH)
    + Add --with-minimum build to CI tests
    + Fix warnings when testing --with-minimum build
    + cmake: Run all tests when threads are disabled
    + Also build CI tests with -Werror
    + Move doc/examples tests to new test suite
    + Simplify 'make check' targets
    + Fix schemas and relaxng tests
    + Remove unused result files
    + Allow missing result files in runtest
    + Move regexp tests to runtest
    + Move SVG tests to runtest.c
    + Move testModule to new test suite
    + Move testThreads to new test suite
    + Remove major parts of old test suite
    + Make testchar return an error on failure
    + Add CI job for static build
    + python/tests: open() relative to test scripts
    + Port some test scripts to Python 3
  * Documentation
    + Improve documentation of tree manipulation API
    + Update xml2-config man page
    + Consolidate man pages
    + Rename xmlcatalog_man.xml
    + Make examples a standalone HTML page
    + Fix documentation in entities.c
    + Add note about optimization flags</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661428800">- Update to version 2.10.1:
  * Regressions: Fix xmlCtxtReadDoc with encoding
  * Bug fixes: Fix HTML parser with threads and --without-legacy
  * Build system:
    + Fix build with Python 3.10
    + cmake: Disable version script on macOS
    + Remove Makefile rule to build testapi.c
  * Documentation:
    + Switch back to HTML output for API documentation
    + Port doc/examples/index.py to Python 3
    + Fix order of exports in libxml2-api.xml
    + Remove libxml2-refs.xml</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661860800">- Update to version 2.10.2:
  * Improvements:
    + Remove set-but-unused variable in xmlXPathScanName
    + Silence -Warray-bounds warning
  * Build system
    + build: require automake-1.16.3 or later
    + Remove generated files from distribution
  * Test suite: Don't create missing.xml when running testapi
- Add configure --with-python=%{__python3} inbefore python build,
  as upstream no longer ships pre-grenerated files.
- Use sed to fix env-script-interpreter in documentation example.
- Pass with-ftp to configure, build ftp support.</changelog>
  <changelog author="pmonreal@suse.com" date="1662033600">- Build for now with --with-legacy to enable APIs that have been
  deprecated recently. (bsc#1202965)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1665748800">- Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304):
  + Security:
  - [CVE-2022-40304] Fix dict corruption caused by entity
    reference cycles
  - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE
  - Fix overflow check in SAX2.c
  + Build system: cmake: Set SOVERSION
- Rebase patches with quilt.</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
  <changelog author="daniel.garcia@suse.com" date="1681905600">- Build also for modern python version (jsc#PED-68)</changelog>
  <changelog author="david.anes@suse.com" date="1682078400">- Remove unneeded dependency (bsc#1209918).</changelog>
  <changelog author="david.anes@suse.com" date="1682078401">- Security update:
  * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings
    isn't deterministic
  - Added patch libxml2-CVE-2023-29469.patch
  * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in
    xmlSchemaFixupComplexType
  - Added patch libxml2-CVE-2023-28484-1.patch
  - Added patch libxml2-CVE-2023-28484-2.patch</changelog>
  <changelog author="david.anes@suse.com" date="1693828800">- Security update:
  * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global
    buffer overflow
  - Added file libxml2-CVE-2023-39615.patch</changelog>
</package>
<package pkgid="15c31ebe3fafec8acd22f039d7085dd6a99c9196a09574f727bfb19bb9cf98de" name="libxml2-tools" arch="s390x">
  <version epoch="0" ver="2.10.3" rel="150500.5.8.1"/>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1622548800">- Update to version 2.9.12
  * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879),
    CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595,
    CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928)
  * Fix null deref in legacy SAX1 parser
  * Fix handling of unexpected EOF in xmlParseContent
  * Fix user-after-free
  * Validate UTF8 in xmlEncodeEntities
  * Fix memory leak in xmlParseElementMixedContentDecl
  * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin
  * Fix SEGV in xmlSAXParseFileWithData
  * Don't process siblings of root in xmlXIncludeProcess
  * Full changes: http://xmlsoft.org/news.html
- Drop upstream fixed
  * libxml2-CVE-2021-3541.patch
  * libxml2-CVE-2021-3537.patch
  * libxml2-CVE-2021-3518.patch
  * libxml2-CVE-2021-3517.patch
  * libxml2-CVE-2021-3516.patch
  * libxml2-CVE-2020-7595.patch
  * libxml2-CVE-2019-20388.patch
  * libxml2-CVE-2020-24977.patch
  * libxml2-CVE-2019-19956.patch
  * libxml2-python39.patch
  * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch
- Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch
- Drop since 2.8.0 merged fix-perl.diff
- Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Fix python-lxml regression with libxml2 2.9.12:
  * Work around lxml API abuse:
    gitlab.gnome.org/GNOME/libxml2/issues/255
- Add upstream patches:
  * libxml2-fix-lxml-corrupted-subtree-structures.patch
  * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch</changelog>
  <changelog author="mcepl@suse.com" date="1634731200">- Rewrite package to the single-spec %python_subpackage_only style and
  eliminate unnecessary multibuild.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1646740800">- Update to version 2.9.13:
  * Security fixes:
    + [CVE-2022-23308] Use-after-free of ID and IDREF attributes
    (boo#1196490);
    + Several memory leaks and another issues.
  * Many regressions fixes.
  * Numerous bug fixes, including, among many others:
    + xmllint's --maxmem option should work as expected now;
    + xmllint now returns an error if arguments are missing.
  * Numerous tests and code and fuzzing fixes and improvements.
  * Updated documentation.
- The full Libxml2 2.9.13 NEWS can be found here:
  https://download.gnome.org/sources/libxml2/2.9/\
  libxml2-2.9.13.news.
- Replace version-release macros in all 3 Obsoletes tag with
  plain 2.9.13 to avoid unwanted behaviors in the future.
- Remove dropped upstream AUTHORS file from list of files to be
  installed in the documentation location with 'cp' command.
- Update http://xmlsoft.org URL tag to Libxml2's new web home:
  https://gitlab.gnome.org/GNOME/libxml2.
- Update ftp://xmlsoft.org Source tag to Libxml2's new download
  host: https://download.gnome.org.
- Drop deprecated Python-2-related macro definitions/conditional
  statement from spec file.
- Drop merged upstream patches:
  libxml2-fix-lxml-corrupted-subtree-structures.patch;
  libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch.
- Drop libxml2.keyring source file as the new download host doesn't
  offer GPG signatures.
- Use ldconfig_scriptlets macro for post(un) handling.</changelog>
  <changelog author="dimstar@opensuse.org" date="1647604800">- Build python bindings in a 2nd run, using multibuild: otherwise,
  libxml2 requires pkgconfig(libxml-2.0) to build, causing issues
  to bootstrap.</changelog>
  <changelog author="david.anes@suse.com" date="1651492800">- Update to 2.9.14:
  * Security:
    + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
    + Fix potential double-free in xmlXPtrStringRangeFunction
    + Fix memory leak in xmlFindCharEncodingHandler
    + Normalize XPath strings in-place
    + Prevent integer-overflow in htmlSkipBlankChars() and
    xmlSkipBlankChars()
    + Fix leak of xmlElementContent
  * Bug fixes:
    + Fix parsing of subtracted regex character classes
    + Fix recursion check in xinclude.c
    + Reset last error in xmlCleanupGlobals
    + Fix certain combinations of regex range quantifiers
    + Fix range quantifier on subregex
  * Improvements:
    + Fix recovery from invalid HTML start tags
  * Build system, portability:
    + Define LFS macros before including system headers
    + Initialize XPath floating-point globals
    + configure: check for icu DEFS
    + configure.ac: produce tar.xz only (GNOME policy)
    + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
    + Fix build with older Python versions
    + Fix --without-valid build</changelog>
  <changelog author="david.anes@suse.com" date="1660824000">- Update to 2.10.0:
  * Security
    + [CVE-2022-2309] Reset nsNr in xmlCtxtReset
    + Reserve byte for NUL terminator and report errors consistently in xmlBuf and
    xmlBuffer
    + Fix missing NUL terminators in xmlBuf and xmlBuffer functions
    + Fix integer overflow in xmlBufferDump()
    + xmlBufAvail() should return length without including a byte for NUL
    terminator
    + Fix ownership of xmlNodePtr &amp; xmlAttrPtr fields in xmlSetTreeDoc()
    + Use xmlNewDocText in xmlXIncludeCopyRange
    + Fix use-after-free bugs when calling xmlTextReaderClose() before
    xmlFreeTextReader() on post-validating parser
    + Use UPDATE_COMPAT() consistently in buf.c
    + fix: xmlXPathParserContext could be double-delete in  OOM case.
  * Removals and deprecations
    + Disable XPointer location support by default
    + Remove outdated xml2Conf.sh
    + Deprecate module init and cleanup functions
    + Remove obsolete XML Software Autoupdate (XSA) file
    + Remove DOCBparser
    + Remove obsolete Python test framework
    + Remove broken VxWorks support
    + Remove broken Mac OS 9 support
    + Remove broken bakefile support
    + Remove broken Visual Studio 2010 support
    + Remove broken Windows CE support
    + Deprecate IDREF-related functions in valid.h
    + Deprecate legacy functions
    + Disable legacy support by default
    + Deprecate all functions in nanoftp.h
    + Disable FTP support by default
    + Add XML_DEPRECATED macro
    + Remove elfgcchack.h
  * Regressions
    + Skip incorrectly opened HTML comments
    + Restore behavior of htmlDocContentDumpFormatOutput()
  * Bug fixes
    + Fix memory leak with invalid XSD
    + Make XPath depth check work with recursive invocations
    + Fix memory leak in xmlLoadEntityContent error path
    + Avoid double-free if malloc fails in inputPush
    + Properly fold whitespace around the QName value when validating an XSD
    schema.
    + Add whitespace folding for some atomic data types that it's missing on.
    + Don't add IDs containing unexpanded entity references
  * Improvements
    + Avoid calling xmlSetTreeDoc
    + Simplify xmlFreeNode
    + Don't reset nsDef when changing node content
    + Fix unintended fall-through in xmlNodeAddContentLen
    + Remove unused xmlBuf functions
    + Implement xpath1() XPointer scheme
    + Add configuration flag for XPointer locations support
    + Fix compiler warnings in Python code
    + Mark more static data as `const`
    + Make xmlStaticCopyNode non-recursive
    + Clean up encoding switching code
    + Simplify recursive pthread mutex
    + Use non-recursive mutex in dict.c
    + Fix parser progress checks
    + Avoid arithmetic on freed pointers
    + Improve buffer allocation scheme
    + Remove unneeded #includes
    + Add support for some non-standard escapes in regular expressions.
    + htmlParseComment: handle abruptly-closed comments
    + Add let variable tag support
    + Add value-of tag support
    + Remove useless call to xmlRelaxNGCleanupTypes
    + Don't include ICU headers in public headers
    + Update `xmlStrlen()` to use POSIX / ISO C `strlen()`
    + Fix unused variable warnings with disabled features
    + Only warn on invalid redeclarations of predefined entities
    + Remove unneeded code in xmlreader.c
    + Rework validation context flags
  * Portability
    + Use NAN/INFINITY if available to init XPath NaN/Inf
    + Fix Python tests on macOS
    + Fix xmlCleanupThreads on Windows
    + Fix reinitialization of library on Windows
    + Don't mix declarations and code in runtest.c
    + Use portable python shebangs
    + Use critical sections as mutex on Windows
    + Don't set HAVE_WIN32_THREADS in win32config.h
    + Use stdint.h with newer MSVC
    + Remove cruft from win32config.h
    + Remove isinf/isnan emulation in win32config.h
    + Always fopen files with "rb"
    + Remove __DJGPP__ checks
    + Remove useless __CYGWIN__ checks
  * Build system
    + Don't autogenerate doc/examples/Makefile.am
    + cmake: Install libxml.m4 on UNIX-like platforms
    + cmake: Use symbol versioning on UNIX-like platforms
    + Port genUnicode.py to Python 3
    + Port gentest.py to Python 3
    + cmake: Fix build without thread support
    + cmake: Install documentation in CMAKE_INSTALL_DOCDIR
    + cmake: Remove non needed files in docs dir
    + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set
    + Move local Autoconf macros into m4 directory
    + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD
    + Update libxml-2.0-uninstalled.pc.in
    + Remove LIBS from XML_PRIVATE_LIBS
    + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS
    + Don't overlink executables
    + cmake: Adjust paths for UNIX or UNIX-like target systems
    + build: Make use of variables in libxml's pkg-config file
    + Avoid obsolescent `test -a` constructs
    + Move AM_MAINTAINER_MODE to AM section
    + configure.ac: make AM_SILENT_RULES([yes]) unconditional
    + Streamline documentation installation
    + Don't try to recreate COPYING symlink
    + Detect libm using libtool's macros
    + configure.ac: disable static libraries by default
    + python/Makefile.am: nest python docs in $(docdir)
    + python/Makefile.am: rely on global AM_INIT_AUTOMAKE
    + Makefile.am: install examples more idiomatically
    + configure.ac: remove useless AC_SUBST
    + Respect `--sysconfdir` in source files
    + Ignore configure backup file created by recent autoreconf too
    + Only install *.html and *.c example files
    + Remove --with-html-dir option
    + Rework documentation build system
    + Remove old website
    + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings
    + Update genChRanges.py
    + Update build_glob.py
    + Remove ICONV_CONST test
    + Remove obsolete AC_HEADER checks
    + Don't check for standard C89 library functions
    + Don't check for standard C89 headers
    + Remove special configuration for certain maintainers
  * Test suite, CI
    + Disable network in API tests
    + testapi: remove leading slash from "/missing.xml"
    + Build Autotools CI tests out of source tree (VPATH)
    + Add --with-minimum build to CI tests
    + Fix warnings when testing --with-minimum build
    + cmake: Run all tests when threads are disabled
    + Also build CI tests with -Werror
    + Move doc/examples tests to new test suite
    + Simplify 'make check' targets
    + Fix schemas and relaxng tests
    + Remove unused result files
    + Allow missing result files in runtest
    + Move regexp tests to runtest
    + Move SVG tests to runtest.c
    + Move testModule to new test suite
    + Move testThreads to new test suite
    + Remove major parts of old test suite
    + Make testchar return an error on failure
    + Add CI job for static build
    + python/tests: open() relative to test scripts
    + Port some test scripts to Python 3
  * Documentation
    + Improve documentation of tree manipulation API
    + Update xml2-config man page
    + Consolidate man pages
    + Rename xmlcatalog_man.xml
    + Make examples a standalone HTML page
    + Fix documentation in entities.c
    + Add note about optimization flags</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661428800">- Update to version 2.10.1:
  * Regressions: Fix xmlCtxtReadDoc with encoding
  * Bug fixes: Fix HTML parser with threads and --without-legacy
  * Build system:
    + Fix build with Python 3.10
    + cmake: Disable version script on macOS
    + Remove Makefile rule to build testapi.c
  * Documentation:
    + Switch back to HTML output for API documentation
    + Port doc/examples/index.py to Python 3
    + Fix order of exports in libxml2-api.xml
    + Remove libxml2-refs.xml</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661860800">- Update to version 2.10.2:
  * Improvements:
    + Remove set-but-unused variable in xmlXPathScanName
    + Silence -Warray-bounds warning
  * Build system
    + build: require automake-1.16.3 or later
    + Remove generated files from distribution
  * Test suite: Don't create missing.xml when running testapi
- Add configure --with-python=%{__python3} inbefore python build,
  as upstream no longer ships pre-grenerated files.
- Use sed to fix env-script-interpreter in documentation example.
- Pass with-ftp to configure, build ftp support.</changelog>
  <changelog author="pmonreal@suse.com" date="1662033600">- Build for now with --with-legacy to enable APIs that have been
  deprecated recently. (bsc#1202965)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1665748800">- Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304):
  + Security:
  - [CVE-2022-40304] Fix dict corruption caused by entity
    reference cycles
  - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE
  - Fix overflow check in SAX2.c
  + Build system: cmake: Set SOVERSION
- Rebase patches with quilt.</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
  <changelog author="daniel.garcia@suse.com" date="1681905600">- Build also for modern python version (jsc#PED-68)</changelog>
  <changelog author="david.anes@suse.com" date="1682078400">- Remove unneeded dependency (bsc#1209918).</changelog>
  <changelog author="david.anes@suse.com" date="1682078401">- Security update:
  * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings
    isn't deterministic
  - Added patch libxml2-CVE-2023-29469.patch
  * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in
    xmlSchemaFixupComplexType
  - Added patch libxml2-CVE-2023-28484-1.patch
  - Added patch libxml2-CVE-2023-28484-2.patch</changelog>
  <changelog author="david.anes@suse.com" date="1693828800">- Security update:
  * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global
    buffer overflow
  - Added file libxml2-CVE-2023-39615.patch</changelog>
</package>
<package pkgid="6d24eb7dab0a50a06f6aa87316876b30efa9ad1ce5974452ae985e303557cfdd" name="libxml2-tools" arch="x86_64">
  <version epoch="0" ver="2.10.3" rel="150500.5.8.1"/>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1622548800">- Update to version 2.9.12
  * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879),
    CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595,
    CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928)
  * Fix null deref in legacy SAX1 parser
  * Fix handling of unexpected EOF in xmlParseContent
  * Fix user-after-free
  * Validate UTF8 in xmlEncodeEntities
  * Fix memory leak in xmlParseElementMixedContentDecl
  * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin
  * Fix SEGV in xmlSAXParseFileWithData
  * Don't process siblings of root in xmlXIncludeProcess
  * Full changes: http://xmlsoft.org/news.html
- Drop upstream fixed
  * libxml2-CVE-2021-3541.patch
  * libxml2-CVE-2021-3537.patch
  * libxml2-CVE-2021-3518.patch
  * libxml2-CVE-2021-3517.patch
  * libxml2-CVE-2021-3516.patch
  * libxml2-CVE-2020-7595.patch
  * libxml2-CVE-2019-20388.patch
  * libxml2-CVE-2020-24977.patch
  * libxml2-CVE-2019-19956.patch
  * libxml2-python39.patch
  * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch
- Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch
- Drop since 2.8.0 merged fix-perl.diff
- Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Fix python-lxml regression with libxml2 2.9.12:
  * Work around lxml API abuse:
    gitlab.gnome.org/GNOME/libxml2/issues/255
- Add upstream patches:
  * libxml2-fix-lxml-corrupted-subtree-structures.patch
  * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch</changelog>
  <changelog author="mcepl@suse.com" date="1634731200">- Rewrite package to the single-spec %python_subpackage_only style and
  eliminate unnecessary multibuild.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1646740800">- Update to version 2.9.13:
  * Security fixes:
    + [CVE-2022-23308] Use-after-free of ID and IDREF attributes
    (boo#1196490);
    + Several memory leaks and another issues.
  * Many regressions fixes.
  * Numerous bug fixes, including, among many others:
    + xmllint's --maxmem option should work as expected now;
    + xmllint now returns an error if arguments are missing.
  * Numerous tests and code and fuzzing fixes and improvements.
  * Updated documentation.
- The full Libxml2 2.9.13 NEWS can be found here:
  https://download.gnome.org/sources/libxml2/2.9/\
  libxml2-2.9.13.news.
- Replace version-release macros in all 3 Obsoletes tag with
  plain 2.9.13 to avoid unwanted behaviors in the future.
- Remove dropped upstream AUTHORS file from list of files to be
  installed in the documentation location with 'cp' command.
- Update http://xmlsoft.org URL tag to Libxml2's new web home:
  https://gitlab.gnome.org/GNOME/libxml2.
- Update ftp://xmlsoft.org Source tag to Libxml2's new download
  host: https://download.gnome.org.
- Drop deprecated Python-2-related macro definitions/conditional
  statement from spec file.
- Drop merged upstream patches:
  libxml2-fix-lxml-corrupted-subtree-structures.patch;
  libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch.
- Drop libxml2.keyring source file as the new download host doesn't
  offer GPG signatures.
- Use ldconfig_scriptlets macro for post(un) handling.</changelog>
  <changelog author="dimstar@opensuse.org" date="1647604800">- Build python bindings in a 2nd run, using multibuild: otherwise,
  libxml2 requires pkgconfig(libxml-2.0) to build, causing issues
  to bootstrap.</changelog>
  <changelog author="david.anes@suse.com" date="1651492800">- Update to 2.9.14:
  * Security:
    + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
    + Fix potential double-free in xmlXPtrStringRangeFunction
    + Fix memory leak in xmlFindCharEncodingHandler
    + Normalize XPath strings in-place
    + Prevent integer-overflow in htmlSkipBlankChars() and
    xmlSkipBlankChars()
    + Fix leak of xmlElementContent
  * Bug fixes:
    + Fix parsing of subtracted regex character classes
    + Fix recursion check in xinclude.c
    + Reset last error in xmlCleanupGlobals
    + Fix certain combinations of regex range quantifiers
    + Fix range quantifier on subregex
  * Improvements:
    + Fix recovery from invalid HTML start tags
  * Build system, portability:
    + Define LFS macros before including system headers
    + Initialize XPath floating-point globals
    + configure: check for icu DEFS
    + configure.ac: produce tar.xz only (GNOME policy)
    + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
    + Fix build with older Python versions
    + Fix --without-valid build</changelog>
  <changelog author="david.anes@suse.com" date="1660824000">- Update to 2.10.0:
  * Security
    + [CVE-2022-2309] Reset nsNr in xmlCtxtReset
    + Reserve byte for NUL terminator and report errors consistently in xmlBuf and
    xmlBuffer
    + Fix missing NUL terminators in xmlBuf and xmlBuffer functions
    + Fix integer overflow in xmlBufferDump()
    + xmlBufAvail() should return length without including a byte for NUL
    terminator
    + Fix ownership of xmlNodePtr &amp; xmlAttrPtr fields in xmlSetTreeDoc()
    + Use xmlNewDocText in xmlXIncludeCopyRange
    + Fix use-after-free bugs when calling xmlTextReaderClose() before
    xmlFreeTextReader() on post-validating parser
    + Use UPDATE_COMPAT() consistently in buf.c
    + fix: xmlXPathParserContext could be double-delete in  OOM case.
  * Removals and deprecations
    + Disable XPointer location support by default
    + Remove outdated xml2Conf.sh
    + Deprecate module init and cleanup functions
    + Remove obsolete XML Software Autoupdate (XSA) file
    + Remove DOCBparser
    + Remove obsolete Python test framework
    + Remove broken VxWorks support
    + Remove broken Mac OS 9 support
    + Remove broken bakefile support
    + Remove broken Visual Studio 2010 support
    + Remove broken Windows CE support
    + Deprecate IDREF-related functions in valid.h
    + Deprecate legacy functions
    + Disable legacy support by default
    + Deprecate all functions in nanoftp.h
    + Disable FTP support by default
    + Add XML_DEPRECATED macro
    + Remove elfgcchack.h
  * Regressions
    + Skip incorrectly opened HTML comments
    + Restore behavior of htmlDocContentDumpFormatOutput()
  * Bug fixes
    + Fix memory leak with invalid XSD
    + Make XPath depth check work with recursive invocations
    + Fix memory leak in xmlLoadEntityContent error path
    + Avoid double-free if malloc fails in inputPush
    + Properly fold whitespace around the QName value when validating an XSD
    schema.
    + Add whitespace folding for some atomic data types that it's missing on.
    + Don't add IDs containing unexpanded entity references
  * Improvements
    + Avoid calling xmlSetTreeDoc
    + Simplify xmlFreeNode
    + Don't reset nsDef when changing node content
    + Fix unintended fall-through in xmlNodeAddContentLen
    + Remove unused xmlBuf functions
    + Implement xpath1() XPointer scheme
    + Add configuration flag for XPointer locations support
    + Fix compiler warnings in Python code
    + Mark more static data as `const`
    + Make xmlStaticCopyNode non-recursive
    + Clean up encoding switching code
    + Simplify recursive pthread mutex
    + Use non-recursive mutex in dict.c
    + Fix parser progress checks
    + Avoid arithmetic on freed pointers
    + Improve buffer allocation scheme
    + Remove unneeded #includes
    + Add support for some non-standard escapes in regular expressions.
    + htmlParseComment: handle abruptly-closed comments
    + Add let variable tag support
    + Add value-of tag support
    + Remove useless call to xmlRelaxNGCleanupTypes
    + Don't include ICU headers in public headers
    + Update `xmlStrlen()` to use POSIX / ISO C `strlen()`
    + Fix unused variable warnings with disabled features
    + Only warn on invalid redeclarations of predefined entities
    + Remove unneeded code in xmlreader.c
    + Rework validation context flags
  * Portability
    + Use NAN/INFINITY if available to init XPath NaN/Inf
    + Fix Python tests on macOS
    + Fix xmlCleanupThreads on Windows
    + Fix reinitialization of library on Windows
    + Don't mix declarations and code in runtest.c
    + Use portable python shebangs
    + Use critical sections as mutex on Windows
    + Don't set HAVE_WIN32_THREADS in win32config.h
    + Use stdint.h with newer MSVC
    + Remove cruft from win32config.h
    + Remove isinf/isnan emulation in win32config.h
    + Always fopen files with "rb"
    + Remove __DJGPP__ checks
    + Remove useless __CYGWIN__ checks
  * Build system
    + Don't autogenerate doc/examples/Makefile.am
    + cmake: Install libxml.m4 on UNIX-like platforms
    + cmake: Use symbol versioning on UNIX-like platforms
    + Port genUnicode.py to Python 3
    + Port gentest.py to Python 3
    + cmake: Fix build without thread support
    + cmake: Install documentation in CMAKE_INSTALL_DOCDIR
    + cmake: Remove non needed files in docs dir
    + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set
    + Move local Autoconf macros into m4 directory
    + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD
    + Update libxml-2.0-uninstalled.pc.in
    + Remove LIBS from XML_PRIVATE_LIBS
    + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS
    + Don't overlink executables
    + cmake: Adjust paths for UNIX or UNIX-like target systems
    + build: Make use of variables in libxml's pkg-config file
    + Avoid obsolescent `test -a` constructs
    + Move AM_MAINTAINER_MODE to AM section
    + configure.ac: make AM_SILENT_RULES([yes]) unconditional
    + Streamline documentation installation
    + Don't try to recreate COPYING symlink
    + Detect libm using libtool's macros
    + configure.ac: disable static libraries by default
    + python/Makefile.am: nest python docs in $(docdir)
    + python/Makefile.am: rely on global AM_INIT_AUTOMAKE
    + Makefile.am: install examples more idiomatically
    + configure.ac: remove useless AC_SUBST
    + Respect `--sysconfdir` in source files
    + Ignore configure backup file created by recent autoreconf too
    + Only install *.html and *.c example files
    + Remove --with-html-dir option
    + Rework documentation build system
    + Remove old website
    + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings
    + Update genChRanges.py
    + Update build_glob.py
    + Remove ICONV_CONST test
    + Remove obsolete AC_HEADER checks
    + Don't check for standard C89 library functions
    + Don't check for standard C89 headers
    + Remove special configuration for certain maintainers
  * Test suite, CI
    + Disable network in API tests
    + testapi: remove leading slash from "/missing.xml"
    + Build Autotools CI tests out of source tree (VPATH)
    + Add --with-minimum build to CI tests
    + Fix warnings when testing --with-minimum build
    + cmake: Run all tests when threads are disabled
    + Also build CI tests with -Werror
    + Move doc/examples tests to new test suite
    + Simplify 'make check' targets
    + Fix schemas and relaxng tests
    + Remove unused result files
    + Allow missing result files in runtest
    + Move regexp tests to runtest
    + Move SVG tests to runtest.c
    + Move testModule to new test suite
    + Move testThreads to new test suite
    + Remove major parts of old test suite
    + Make testchar return an error on failure
    + Add CI job for static build
    + python/tests: open() relative to test scripts
    + Port some test scripts to Python 3
  * Documentation
    + Improve documentation of tree manipulation API
    + Update xml2-config man page
    + Consolidate man pages
    + Rename xmlcatalog_man.xml
    + Make examples a standalone HTML page
    + Fix documentation in entities.c
    + Add note about optimization flags</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661428800">- Update to version 2.10.1:
  * Regressions: Fix xmlCtxtReadDoc with encoding
  * Bug fixes: Fix HTML parser with threads and --without-legacy
  * Build system:
    + Fix build with Python 3.10
    + cmake: Disable version script on macOS
    + Remove Makefile rule to build testapi.c
  * Documentation:
    + Switch back to HTML output for API documentation
    + Port doc/examples/index.py to Python 3
    + Fix order of exports in libxml2-api.xml
    + Remove libxml2-refs.xml</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661860800">- Update to version 2.10.2:
  * Improvements:
    + Remove set-but-unused variable in xmlXPathScanName
    + Silence -Warray-bounds warning
  * Build system
    + build: require automake-1.16.3 or later
    + Remove generated files from distribution
  * Test suite: Don't create missing.xml when running testapi
- Add configure --with-python=%{__python3} inbefore python build,
  as upstream no longer ships pre-grenerated files.
- Use sed to fix env-script-interpreter in documentation example.
- Pass with-ftp to configure, build ftp support.</changelog>
  <changelog author="pmonreal@suse.com" date="1662033600">- Build for now with --with-legacy to enable APIs that have been
  deprecated recently. (bsc#1202965)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1665748800">- Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304):
  + Security:
  - [CVE-2022-40304] Fix dict corruption caused by entity
    reference cycles
  - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE
  - Fix overflow check in SAX2.c
  + Build system: cmake: Set SOVERSION
- Rebase patches with quilt.</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
  <changelog author="daniel.garcia@suse.com" date="1681905600">- Build also for modern python version (jsc#PED-68)</changelog>
  <changelog author="david.anes@suse.com" date="1682078400">- Remove unneeded dependency (bsc#1209918).</changelog>
  <changelog author="david.anes@suse.com" date="1682078401">- Security update:
  * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings
    isn't deterministic
  - Added patch libxml2-CVE-2023-29469.patch
  * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in
    xmlSchemaFixupComplexType
  - Added patch libxml2-CVE-2023-28484-1.patch
  - Added patch libxml2-CVE-2023-28484-2.patch</changelog>
  <changelog author="david.anes@suse.com" date="1693828800">- Security update:
  * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global
    buffer overflow
  - Added file libxml2-CVE-2023-39615.patch</changelog>
</package>
<package pkgid="9d2620141b82d98836a7ebc163a797fd8c956cc7955915f53f8e3c664b921b49" name="libz1" arch="aarch64">
  <version epoch="0" ver="1.2.13" rel="150500.4.3.1"/>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="coolo@suse.com" date="1600257600">- Provide a testsuite subpackage to run post-build validation</changelog>
  <changelog author="lnussel@suse.de" date="1603886400">- install to /usr (boo#1029961)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1604923200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1647000000">- Don't install (internal) crypt.h header in minizip
  * minizip-dont-install-crypt-header.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch - CVE-2018-25032
- Update 410.patch
  * Remove included patches:
    bsc1174551-fxi-imcomplete-raw-streams.patch
    zlib-compression-switching.patch
    zlib-s390x-z15-fix-hw-compression.patch
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch</changelog>
  <changelog author="meissner@suse.com" date="1656763200">- switch to https urls</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661256000">- Update to 1.2.12:
  * A lot of bug fixes
  * Improve speed of crc32 functions
  * Use ARM crc32 instructions if the ARM architecture has them
  For the complete changes, see ChangeLog
- Fixes CVE-2022-37434,  heap-based buffer over-read or buffer overflow in
  inflate.c via a large gzip header extra field
  (CVE-2022-37434, bsc#1202175)
- Added patches:
  * zlib-1.2.11-covscan-issues-rhel9.patch
  * zlib-1.2.11-covscan-issues.patch
  * zlib-1.2.12-s390-vectorize-crc32.patch
  * zlib-1.2.12-optimized-crc32-power8.patch
  * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.12-fix-configure.patch
  * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch
  * zlib-1.2.12-fix-CVE-2022-37434.patch
  * zlib-1.2.5-minizip-fixuncrypt.patch
- Removed patches:
  * bsc1197459.patch (upstreamed)
  * zlib-power8-fate325307.patch
    (replaced by zlib-1.2.12-optimized-crc32-power8.patch)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
    (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch)
  * 410.patch
    (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch)
- Refreshed patches:
  * zlib-format.patch
  * zlib-no-version-check.patch
- Disable profiling since it breaks tests
- Update zlib-rpmlintrc</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665403200">- Add Power8 optimizations:
  * zlib-1.2.12-add-optimized-slide_hash-for-power.patch
  * zlib-1.2.12-add-vectorized-longest_match-for-power.patch
  * zlib-1.2.12-adler32-vector-optimizations-for-power.patch
  * zlib-1.2.12-fix-invalid-memory-access-on-ppc-and-ppc64.patch
- Update zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch</changelog>
  <changelog author="dmueller@suse.com" date="1670760000">- build zlib with optflags again</changelog>
  <changelog author="danilo.spinella@suse.com" date="1674129600">- Update to 1.13:
  * Fix configure issue that discarded provided CC definition
  * Correct incorrect inputs provided to the CRC functions
  * Repair prototypes and exporting of new CRC functions
  * Fix inflateBack to detect invalid input with distances too far
  * Have infback() deliver all of the available output up to any error
  * Fix a bug when getting a gzip header extra field with inflate()
  * Fix bug in block type selection when Z_FIXED used
  * Tighten deflateBound bounds
  * Remove deleted assembler code references
  * Various portability and appearance improvements
- Added patches:
  * zlib-1.2.13-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.13-fix-bug-deflateBound.patch
  * zlib-1.2.13-optimized-s390.patch
- Refreshed patches:
  * zlib-1.2.12-add-optimized-slide_hash-for-power.patch
  * zlib-1.2.12-add-vectorized-longest_match-for-power.patch
  * zlib-1.2.12-s390-vectorize-crc32.patch
- Removed patches:
  * zlib-1.2.12-fix-configure.patch
  * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.12-optimized-crc32-power8.patch
  * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch
  * zlib-1.2.12-fix-CVE-2022-37434.patch
  * zlib-1.2.11-optimized-s390.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1683201600">- Fix deflateBound() before deflateInit(), bsc#1210593, bsc#1211005
  bsc1210593.patch</changelog>
  <changelog author="oss@danyspin97.org" date="1697716800">- Fix CVE-2023-45853, integer overflow and resultant heap-based buffer
  overflow in zipOpenNewFileInZip4_6, bsc#1216378
  * CVE-2023-45853.patch</changelog>
</package>
<package pkgid="703487f8a21a5828e12fa1837e68e74baa38f0f029addf317a17be6f3b248aa4" name="libz1" arch="s390x">
  <version epoch="0" ver="1.2.13" rel="150500.4.3.1"/>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="coolo@suse.com" date="1600257600">- Provide a testsuite subpackage to run post-build validation</changelog>
  <changelog author="lnussel@suse.de" date="1603886400">- install to /usr (boo#1029961)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1604923200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1647000000">- Don't install (internal) crypt.h header in minizip
  * minizip-dont-install-crypt-header.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch - CVE-2018-25032
- Update 410.patch
  * Remove included patches:
    bsc1174551-fxi-imcomplete-raw-streams.patch
    zlib-compression-switching.patch
    zlib-s390x-z15-fix-hw-compression.patch
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch</changelog>
  <changelog author="meissner@suse.com" date="1656763200">- switch to https urls</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661256000">- Update to 1.2.12:
  * A lot of bug fixes
  * Improve speed of crc32 functions
  * Use ARM crc32 instructions if the ARM architecture has them
  For the complete changes, see ChangeLog
- Fixes CVE-2022-37434,  heap-based buffer over-read or buffer overflow in
  inflate.c via a large gzip header extra field
  (CVE-2022-37434, bsc#1202175)
- Added patches:
  * zlib-1.2.11-covscan-issues-rhel9.patch
  * zlib-1.2.11-covscan-issues.patch
  * zlib-1.2.12-s390-vectorize-crc32.patch
  * zlib-1.2.12-optimized-crc32-power8.patch
  * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.12-fix-configure.patch
  * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch
  * zlib-1.2.12-fix-CVE-2022-37434.patch
  * zlib-1.2.5-minizip-fixuncrypt.patch
- Removed patches:
  * bsc1197459.patch (upstreamed)
  * zlib-power8-fate325307.patch
    (replaced by zlib-1.2.12-optimized-crc32-power8.patch)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
    (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch)
  * 410.patch
    (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch)
- Refreshed patches:
  * zlib-format.patch
  * zlib-no-version-check.patch
- Disable profiling since it breaks tests
- Update zlib-rpmlintrc</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665403200">- Add Power8 optimizations:
  * zlib-1.2.12-add-optimized-slide_hash-for-power.patch
  * zlib-1.2.12-add-vectorized-longest_match-for-power.patch
  * zlib-1.2.12-adler32-vector-optimizations-for-power.patch
  * zlib-1.2.12-fix-invalid-memory-access-on-ppc-and-ppc64.patch
- Update zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch</changelog>
  <changelog author="dmueller@suse.com" date="1670760000">- build zlib with optflags again</changelog>
  <changelog author="danilo.spinella@suse.com" date="1674129600">- Update to 1.13:
  * Fix configure issue that discarded provided CC definition
  * Correct incorrect inputs provided to the CRC functions
  * Repair prototypes and exporting of new CRC functions
  * Fix inflateBack to detect invalid input with distances too far
  * Have infback() deliver all of the available output up to any error
  * Fix a bug when getting a gzip header extra field with inflate()
  * Fix bug in block type selection when Z_FIXED used
  * Tighten deflateBound bounds
  * Remove deleted assembler code references
  * Various portability and appearance improvements
- Added patches:
  * zlib-1.2.13-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.13-fix-bug-deflateBound.patch
  * zlib-1.2.13-optimized-s390.patch
- Refreshed patches:
  * zlib-1.2.12-add-optimized-slide_hash-for-power.patch
  * zlib-1.2.12-add-vectorized-longest_match-for-power.patch
  * zlib-1.2.12-s390-vectorize-crc32.patch
- Removed patches:
  * zlib-1.2.12-fix-configure.patch
  * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.12-optimized-crc32-power8.patch
  * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch
  * zlib-1.2.12-fix-CVE-2022-37434.patch
  * zlib-1.2.11-optimized-s390.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1683201600">- Fix deflateBound() before deflateInit(), bsc#1210593, bsc#1211005
  bsc1210593.patch</changelog>
  <changelog author="oss@danyspin97.org" date="1697716800">- Fix CVE-2023-45853, integer overflow and resultant heap-based buffer
  overflow in zipOpenNewFileInZip4_6, bsc#1216378
  * CVE-2023-45853.patch</changelog>
</package>
<package pkgid="1f273509bd76f485a289e23791a3d9c5fec7b982fe91f59000d191d40375840d" name="libz1" arch="x86_64">
  <version epoch="0" ver="1.2.13" rel="150500.4.3.1"/>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="coolo@suse.com" date="1600257600">- Provide a testsuite subpackage to run post-build validation</changelog>
  <changelog author="lnussel@suse.de" date="1603886400">- install to /usr (boo#1029961)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1604923200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1647000000">- Don't install (internal) crypt.h header in minizip
  * minizip-dont-install-crypt-header.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch - CVE-2018-25032
- Update 410.patch
  * Remove included patches:
    bsc1174551-fxi-imcomplete-raw-streams.patch
    zlib-compression-switching.patch
    zlib-s390x-z15-fix-hw-compression.patch
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch</changelog>
  <changelog author="meissner@suse.com" date="1656763200">- switch to https urls</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661256000">- Update to 1.2.12:
  * A lot of bug fixes
  * Improve speed of crc32 functions
  * Use ARM crc32 instructions if the ARM architecture has them
  For the complete changes, see ChangeLog
- Fixes CVE-2022-37434,  heap-based buffer over-read or buffer overflow in
  inflate.c via a large gzip header extra field
  (CVE-2022-37434, bsc#1202175)
- Added patches:
  * zlib-1.2.11-covscan-issues-rhel9.patch
  * zlib-1.2.11-covscan-issues.patch
  * zlib-1.2.12-s390-vectorize-crc32.patch
  * zlib-1.2.12-optimized-crc32-power8.patch
  * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.12-fix-configure.patch
  * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch
  * zlib-1.2.12-fix-CVE-2022-37434.patch
  * zlib-1.2.5-minizip-fixuncrypt.patch
- Removed patches:
  * bsc1197459.patch (upstreamed)
  * zlib-power8-fate325307.patch
    (replaced by zlib-1.2.12-optimized-crc32-power8.patch)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
    (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch)
  * 410.patch
    (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch)
- Refreshed patches:
  * zlib-format.patch
  * zlib-no-version-check.patch
- Disable profiling since it breaks tests
- Update zlib-rpmlintrc</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665403200">- Add Power8 optimizations:
  * zlib-1.2.12-add-optimized-slide_hash-for-power.patch
  * zlib-1.2.12-add-vectorized-longest_match-for-power.patch
  * zlib-1.2.12-adler32-vector-optimizations-for-power.patch
  * zlib-1.2.12-fix-invalid-memory-access-on-ppc-and-ppc64.patch
- Update zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch</changelog>
  <changelog author="dmueller@suse.com" date="1670760000">- build zlib with optflags again</changelog>
  <changelog author="danilo.spinella@suse.com" date="1674129600">- Update to 1.13:
  * Fix configure issue that discarded provided CC definition
  * Correct incorrect inputs provided to the CRC functions
  * Repair prototypes and exporting of new CRC functions
  * Fix inflateBack to detect invalid input with distances too far
  * Have infback() deliver all of the available output up to any error
  * Fix a bug when getting a gzip header extra field with inflate()
  * Fix bug in block type selection when Z_FIXED used
  * Tighten deflateBound bounds
  * Remove deleted assembler code references
  * Various portability and appearance improvements
- Added patches:
  * zlib-1.2.13-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.13-fix-bug-deflateBound.patch
  * zlib-1.2.13-optimized-s390.patch
- Refreshed patches:
  * zlib-1.2.12-add-optimized-slide_hash-for-power.patch
  * zlib-1.2.12-add-vectorized-longest_match-for-power.patch
  * zlib-1.2.12-s390-vectorize-crc32.patch
- Removed patches:
  * zlib-1.2.12-fix-configure.patch
  * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.12-optimized-crc32-power8.patch
  * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch
  * zlib-1.2.12-fix-CVE-2022-37434.patch
  * zlib-1.2.11-optimized-s390.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1683201600">- Fix deflateBound() before deflateInit(), bsc#1210593, bsc#1211005
  bsc1210593.patch</changelog>
  <changelog author="oss@danyspin97.org" date="1697716800">- Fix CVE-2023-45853, integer overflow and resultant heap-based buffer
  overflow in zipOpenNewFileInZip4_6, bsc#1216378
  * CVE-2023-45853.patch</changelog>
</package>
<package pkgid="b1e1194a07b15def9ad047df1c35b5b696e0cda319c9bf8a2734e2c06530d060" name="libzck1" arch="aarch64">
  <version epoch="0" ver="1.1.16" rel="150400.3.7.1"/>
  <changelog author="ngompa13@gmail.com" date="1530792000">- Initial packaging based on Mageia package</changelog>
  <changelog author="ngompa13@gmail.com" date="1531828800">- Update to 0.7.6
  + SHA-512 and SHA-512/128 support
  + New default chunk checksum type SHA-512/128
  + Automatic chunking moved into libzck and is now default
  + New option to disable automatic chunking
  + Bugfixes</changelog>
  <changelog author="mpluskal@suse.com" date="1531915200">- Do not manually specify dependencies which are automatically
  generated
- Make requirements of devel package less strict</changelog>
  <changelog author="ngompa13@gmail.com" date="1538222400">- Rebase to 0.9.11
  + Fix small bug where creating a zck_dl context fails when zck
    context is NULL
  + Fix security bugs found by Coverity
  + Fix test failures for zstd &lt;= 1.3.4
  + Add gen_xml_dictionary to libexecdir with zck_ prefix
  + Fix intermittent bug where auto-chunking wasn't deterministic
  + ABI (but not API change) - Use bool from stdbool.h
  + Allow specification of output file in zck
  + Set minimum and maximum chunk sizes for both automatic and
    manual chunking
  + New error handling functions
  + File format changes
  + API changes
- Make requirements between subpackages stricter to avoid issues
  due to inter-subpackage ABI/API changes</changelog>
  <changelog author="ngompa13@gmail.com" date="1538222401">- Bump meson build dependency to match meson.build requirement</changelog>
  <changelog author="aloisio@gmx.com" date="1540814400">- Update to version 0.9.13
  * Add read support for zchunk files with optional flags
  * Fix tests for zstd-1.3.6</changelog>
  <changelog author="ngompa13@gmail.com" date="1545048000">- Update to version 0.9.17
  + Turn off some tests for big-endian architectures since zstd
    isn't deterministic on them
  + Add zck_gen_zdict binary to generate optimal zdict for a zchunk file
  + Add functions to API to simplify extracting a single chunk
  + Change default zstd compression to 9 for a 6x speed increase in
    compression speed for a 5% increase in compression size
  + Switch from optional flags to more robust optional elements
  + Sanity check hex hashes passed in as an option</changelog>
  <changelog author="ngompa13@gmail.com" date="1548244800">- Update to version 1.0.2
  + Use hash table for finding identical chunks, speeding up process
    considerably
  + Add test case to verify that identical chunk checking is working</changelog>
  <changelog author="ngompa13@gmail.com" date="1548331200">- Backport patch from upstream to fix bugs discovered by Coverity
  + Add patch: 0001-Fix-some-small-bugs-found-by-Coverity.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1548331201">- Update to version 1.0.3
  + Fix some small bugs found by Coverity
  + Fix memory leak and off-by-one errors
- Drop patches part of 1.0.3 release
  + 0001-Fix-some-small-bugs-found-by-Coverity.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1554033600">- Update to version 1.1.0
  + Fix multipart boundary bug when dealing with lighttpd servers
  + Optimize chunk matching while downloading, significantly reducing CPU usage</changelog>
  <changelog author="mpluskal@suse.com" date="1576670400">- Update to version 1.1.4:
  * Simplify regex for detecting part header info
  * Fix coverity warnings
  * Open files with permissions 0666 and let umask(2) do its job.
  * Multipart boundary field can be quoted.</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Update to version 1.1.5
  + Handle write errors correctly</changelog>
  <changelog author="dimstar@opensuse.org" date="1609761600">- Add d2eae512bee09a4047cfe586de12f644d73b0736.patch: Fix build
  with zstd 1.4.7+.</changelog>
  <changelog author="rpm@fthiessen.de" date="1619438400">- Update to version 1.1.9
  * Handle zstd 1.4.7+
  * Update documentation
  * unzck: require a *.zck extension
  * General bug fixes
- Dropped upstream merged
  d2eae512bee09a4047cfe586de12f644d73b0736.patch
- Add fix-test-argp.patch: Fix argp detection</changelog>
  <changelog author="rpm@fthiessen.de" date="1620043200">- Update to version 1.1.11
  * Fix memory leak of zck-&gt;prep_digest
  * Fix argp detection
  * Handle certain rare web servers that don't start with \r\n
- Drop upstream merged fix-test-argp.patch</changelog>
  <changelog author="ismail@i10z.com" date="1621080000">- Update to version 1.1.12
  * Update testsuite for zstd 1.5</changelog>
  <changelog author="ismail@i10z.com" date="1621598400">- Update to version 1.1.14
  * Final fixes for zstd 1.5 support</changelog>
  <changelog author="rpm@fthiessen.de" date="1624536000">- Update to version 1.1.16
  * Fix major bug when compressing with dictionary</changelog>
  <changelog author="ali.abdallah@suse.com" date="1697716800">- Fix CVE-2023-46228, bsc#1216268
  * Handle overflow errors in malformed zchunk files.
- Added patch:
  * CVE-2023-46228.patch</changelog>
</package>
<package pkgid="3bf8a4ae69befc7ff94157d51adbc143d93c11e12ee56fcde8c7929f0d06850e" name="libzck1" arch="s390x">
  <version epoch="0" ver="1.1.16" rel="150400.3.7.1"/>
  <changelog author="ngompa13@gmail.com" date="1530792000">- Initial packaging based on Mageia package</changelog>
  <changelog author="ngompa13@gmail.com" date="1531828800">- Update to 0.7.6
  + SHA-512 and SHA-512/128 support
  + New default chunk checksum type SHA-512/128
  + Automatic chunking moved into libzck and is now default
  + New option to disable automatic chunking
  + Bugfixes</changelog>
  <changelog author="mpluskal@suse.com" date="1531915200">- Do not manually specify dependencies which are automatically
  generated
- Make requirements of devel package less strict</changelog>
  <changelog author="ngompa13@gmail.com" date="1538222400">- Rebase to 0.9.11
  + Fix small bug where creating a zck_dl context fails when zck
    context is NULL
  + Fix security bugs found by Coverity
  + Fix test failures for zstd &lt;= 1.3.4
  + Add gen_xml_dictionary to libexecdir with zck_ prefix
  + Fix intermittent bug where auto-chunking wasn't deterministic
  + ABI (but not API change) - Use bool from stdbool.h
  + Allow specification of output file in zck
  + Set minimum and maximum chunk sizes for both automatic and
    manual chunking
  + New error handling functions
  + File format changes
  + API changes
- Make requirements between subpackages stricter to avoid issues
  due to inter-subpackage ABI/API changes</changelog>
  <changelog author="ngompa13@gmail.com" date="1538222401">- Bump meson build dependency to match meson.build requirement</changelog>
  <changelog author="aloisio@gmx.com" date="1540814400">- Update to version 0.9.13
  * Add read support for zchunk files with optional flags
  * Fix tests for zstd-1.3.6</changelog>
  <changelog author="ngompa13@gmail.com" date="1545048000">- Update to version 0.9.17
  + Turn off some tests for big-endian architectures since zstd
    isn't deterministic on them
  + Add zck_gen_zdict binary to generate optimal zdict for a zchunk file
  + Add functions to API to simplify extracting a single chunk
  + Change default zstd compression to 9 for a 6x speed increase in
    compression speed for a 5% increase in compression size
  + Switch from optional flags to more robust optional elements
  + Sanity check hex hashes passed in as an option</changelog>
  <changelog author="ngompa13@gmail.com" date="1548244800">- Update to version 1.0.2
  + Use hash table for finding identical chunks, speeding up process
    considerably
  + Add test case to verify that identical chunk checking is working</changelog>
  <changelog author="ngompa13@gmail.com" date="1548331200">- Backport patch from upstream to fix bugs discovered by Coverity
  + Add patch: 0001-Fix-some-small-bugs-found-by-Coverity.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1548331201">- Update to version 1.0.3
  + Fix some small bugs found by Coverity
  + Fix memory leak and off-by-one errors
- Drop patches part of 1.0.3 release
  + 0001-Fix-some-small-bugs-found-by-Coverity.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1554033600">- Update to version 1.1.0
  + Fix multipart boundary bug when dealing with lighttpd servers
  + Optimize chunk matching while downloading, significantly reducing CPU usage</changelog>
  <changelog author="mpluskal@suse.com" date="1576670400">- Update to version 1.1.4:
  * Simplify regex for detecting part header info
  * Fix coverity warnings
  * Open files with permissions 0666 and let umask(2) do its job.
  * Multipart boundary field can be quoted.</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Update to version 1.1.5
  + Handle write errors correctly</changelog>
  <changelog author="dimstar@opensuse.org" date="1609761600">- Add d2eae512bee09a4047cfe586de12f644d73b0736.patch: Fix build
  with zstd 1.4.7+.</changelog>
  <changelog author="rpm@fthiessen.de" date="1619438400">- Update to version 1.1.9
  * Handle zstd 1.4.7+
  * Update documentation
  * unzck: require a *.zck extension
  * General bug fixes
- Dropped upstream merged
  d2eae512bee09a4047cfe586de12f644d73b0736.patch
- Add fix-test-argp.patch: Fix argp detection</changelog>
  <changelog author="rpm@fthiessen.de" date="1620043200">- Update to version 1.1.11
  * Fix memory leak of zck-&gt;prep_digest
  * Fix argp detection
  * Handle certain rare web servers that don't start with \r\n
- Drop upstream merged fix-test-argp.patch</changelog>
  <changelog author="ismail@i10z.com" date="1621080000">- Update to version 1.1.12
  * Update testsuite for zstd 1.5</changelog>
  <changelog author="ismail@i10z.com" date="1621598400">- Update to version 1.1.14
  * Final fixes for zstd 1.5 support</changelog>
  <changelog author="rpm@fthiessen.de" date="1624536000">- Update to version 1.1.16
  * Fix major bug when compressing with dictionary</changelog>
  <changelog author="ali.abdallah@suse.com" date="1697716800">- Fix CVE-2023-46228, bsc#1216268
  * Handle overflow errors in malformed zchunk files.
- Added patch:
  * CVE-2023-46228.patch</changelog>
</package>
<package pkgid="2bcb4da09db4f7ce96345a1b6c7226d417f5983857b16eec0f529ad325299de5" name="libzck1" arch="x86_64">
  <version epoch="0" ver="1.1.16" rel="150400.3.7.1"/>
  <changelog author="ngompa13@gmail.com" date="1530792000">- Initial packaging based on Mageia package</changelog>
  <changelog author="ngompa13@gmail.com" date="1531828800">- Update to 0.7.6
  + SHA-512 and SHA-512/128 support
  + New default chunk checksum type SHA-512/128
  + Automatic chunking moved into libzck and is now default
  + New option to disable automatic chunking
  + Bugfixes</changelog>
  <changelog author="mpluskal@suse.com" date="1531915200">- Do not manually specify dependencies which are automatically
  generated
- Make requirements of devel package less strict</changelog>
  <changelog author="ngompa13@gmail.com" date="1538222400">- Rebase to 0.9.11
  + Fix small bug where creating a zck_dl context fails when zck
    context is NULL
  + Fix security bugs found by Coverity
  + Fix test failures for zstd &lt;= 1.3.4
  + Add gen_xml_dictionary to libexecdir with zck_ prefix
  + Fix intermittent bug where auto-chunking wasn't deterministic
  + ABI (but not API change) - Use bool from stdbool.h
  + Allow specification of output file in zck
  + Set minimum and maximum chunk sizes for both automatic and
    manual chunking
  + New error handling functions
  + File format changes
  + API changes
- Make requirements between subpackages stricter to avoid issues
  due to inter-subpackage ABI/API changes</changelog>
  <changelog author="ngompa13@gmail.com" date="1538222401">- Bump meson build dependency to match meson.build requirement</changelog>
  <changelog author="aloisio@gmx.com" date="1540814400">- Update to version 0.9.13
  * Add read support for zchunk files with optional flags
  * Fix tests for zstd-1.3.6</changelog>
  <changelog author="ngompa13@gmail.com" date="1545048000">- Update to version 0.9.17
  + Turn off some tests for big-endian architectures since zstd
    isn't deterministic on them
  + Add zck_gen_zdict binary to generate optimal zdict for a zchunk file
  + Add functions to API to simplify extracting a single chunk
  + Change default zstd compression to 9 for a 6x speed increase in
    compression speed for a 5% increase in compression size
  + Switch from optional flags to more robust optional elements
  + Sanity check hex hashes passed in as an option</changelog>
  <changelog author="ngompa13@gmail.com" date="1548244800">- Update to version 1.0.2
  + Use hash table for finding identical chunks, speeding up process
    considerably
  + Add test case to verify that identical chunk checking is working</changelog>
  <changelog author="ngompa13@gmail.com" date="1548331200">- Backport patch from upstream to fix bugs discovered by Coverity
  + Add patch: 0001-Fix-some-small-bugs-found-by-Coverity.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1548331201">- Update to version 1.0.3
  + Fix some small bugs found by Coverity
  + Fix memory leak and off-by-one errors
- Drop patches part of 1.0.3 release
  + 0001-Fix-some-small-bugs-found-by-Coverity.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1554033600">- Update to version 1.1.0
  + Fix multipart boundary bug when dealing with lighttpd servers
  + Optimize chunk matching while downloading, significantly reducing CPU usage</changelog>
  <changelog author="mpluskal@suse.com" date="1576670400">- Update to version 1.1.4:
  * Simplify regex for detecting part header info
  * Fix coverity warnings
  * Open files with permissions 0666 and let umask(2) do its job.
  * Multipart boundary field can be quoted.</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Update to version 1.1.5
  + Handle write errors correctly</changelog>
  <changelog author="dimstar@opensuse.org" date="1609761600">- Add d2eae512bee09a4047cfe586de12f644d73b0736.patch: Fix build
  with zstd 1.4.7+.</changelog>
  <changelog author="rpm@fthiessen.de" date="1619438400">- Update to version 1.1.9
  * Handle zstd 1.4.7+
  * Update documentation
  * unzck: require a *.zck extension
  * General bug fixes
- Dropped upstream merged
  d2eae512bee09a4047cfe586de12f644d73b0736.patch
- Add fix-test-argp.patch: Fix argp detection</changelog>
  <changelog author="rpm@fthiessen.de" date="1620043200">- Update to version 1.1.11
  * Fix memory leak of zck-&gt;prep_digest
  * Fix argp detection
  * Handle certain rare web servers that don't start with \r\n
- Drop upstream merged fix-test-argp.patch</changelog>
  <changelog author="ismail@i10z.com" date="1621080000">- Update to version 1.1.12
  * Update testsuite for zstd 1.5</changelog>
  <changelog author="ismail@i10z.com" date="1621598400">- Update to version 1.1.14
  * Final fixes for zstd 1.5 support</changelog>
  <changelog author="rpm@fthiessen.de" date="1624536000">- Update to version 1.1.16
  * Fix major bug when compressing with dictionary</changelog>
  <changelog author="ali.abdallah@suse.com" date="1697716800">- Fix CVE-2023-46228, bsc#1216268
  * Handle overflow errors in malformed zchunk files.
- Added patch:
  * CVE-2023-46228.patch</changelog>
</package>
<package pkgid="4aff597cefc9da2305a4a4b57ac9458b9fe6c84a284c20e3ebf915acd0c731da" name="nfs-client" arch="aarch64">
  <version epoch="0" ver="2.1.1" rel="150500.22.3.1"/>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
  <changelog author="nfbrown@suse.com" date="1648123200">- Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch
  Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch
  Ensure "sloppy" is added correctly for newer kernels.  Particularly
  required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels.
  (boo#1197297)</changelog>
  <changelog author="nfbrown@suse.com" date="1648814400">- Add 0023-cache.c-removed-a-couple-warning.patch
  Fix compilation with new glibc (SLE15-SP4)
  (bsc#1197788)</changelog>
  <changelog author="nfbrown@suse.com" date="1655208000">- 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch
  Ensure sysctl setting work (bsc#1199856)</changelog>
  <changelog author="nfbrown@suse.com" date="1662379200">- add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch
  Fix nfsdcltrack bug that affected non-x86 archs.
  (bsc#1202627)</changelog>
  <changelog author="nfbrown@suse.com" date="1673697600">- 0026-modprobe-avoid-error-messages-if-sbin-sysctl-fail.patch
  Avoid modprobe errors when sysctl is not installed.
  (bsc#1200710 bsc#1207022 bsc#1206781)
- 0027-nfsd-allow-server-scope-to-be-set-with-config-or-com.patch
  Add "-S scope" option to rpc.nfsd to simplify fail-over cluster
  config.
  (bsc#1203746)</changelog>
  <changelog author="nfbrown@suse.com" date="1675684800">- Rename all drop-in options.conf files as 10-options.conf
  This makes it easier for other packages to over-ride
  with a drop-in with a later sequence number.
  resource-agents does this.
  (bsc#1207843)</changelog>
  <changelog author="nfbrown@suse.com" date="1680091200">- Add 0028-mount.nfs-always-include-mountpoint-or-spec-if-error.patch
  boo#1157881
- Add 0029-nfsd.man-fix-typo-in-section-on-scope.patch
  bsc#1209859
- Allow scope to be set in sysconfig: NFSD_SCOPE</changelog>
  <changelog author="nfbrown@suse.com" date="1686052800">- Add 0030-systemd-use-correct-modprobe-d-directory
  SLE15-SP5 an earlier don't use /usr/lib/modprobe.d
  (bsc#1200710)
- Add 0031-mountd-don-t-advertise-krb5-for-v4root-when-not-conf.patch
  Avoid unhelpful warning if rpcsec_gss_krb5.ko not installed</changelog>
  <changelog author="nfbrown@suse.com" date="1687867200">- Add 0032-exportfs-Ingnore-export-failures-in-nfs-server.seriv.patch
  Inconsistencies in /etc/exports shouldn't be fatal.
  (bsc#1212594)</changelog>
</package>
<package pkgid="b708a92f85866ac4e3e9be335ec6c4c30524f324ff9fb62dcaac7ef7ace52c67" name="nfs-client" arch="s390x">
  <version epoch="0" ver="2.1.1" rel="150500.22.3.1"/>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
  <changelog author="nfbrown@suse.com" date="1648123200">- Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch
  Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch
  Ensure "sloppy" is added correctly for newer kernels.  Particularly
  required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels.
  (boo#1197297)</changelog>
  <changelog author="nfbrown@suse.com" date="1648814400">- Add 0023-cache.c-removed-a-couple-warning.patch
  Fix compilation with new glibc (SLE15-SP4)
  (bsc#1197788)</changelog>
  <changelog author="nfbrown@suse.com" date="1655208000">- 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch
  Ensure sysctl setting work (bsc#1199856)</changelog>
  <changelog author="nfbrown@suse.com" date="1662379200">- add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch
  Fix nfsdcltrack bug that affected non-x86 archs.
  (bsc#1202627)</changelog>
  <changelog author="nfbrown@suse.com" date="1673697600">- 0026-modprobe-avoid-error-messages-if-sbin-sysctl-fail.patch
  Avoid modprobe errors when sysctl is not installed.
  (bsc#1200710 bsc#1207022 bsc#1206781)
- 0027-nfsd-allow-server-scope-to-be-set-with-config-or-com.patch
  Add "-S scope" option to rpc.nfsd to simplify fail-over cluster
  config.
  (bsc#1203746)</changelog>
  <changelog author="nfbrown@suse.com" date="1675684800">- Rename all drop-in options.conf files as 10-options.conf
  This makes it easier for other packages to over-ride
  with a drop-in with a later sequence number.
  resource-agents does this.
  (bsc#1207843)</changelog>
  <changelog author="nfbrown@suse.com" date="1680091200">- Add 0028-mount.nfs-always-include-mountpoint-or-spec-if-error.patch
  boo#1157881
- Add 0029-nfsd.man-fix-typo-in-section-on-scope.patch
  bsc#1209859
- Allow scope to be set in sysconfig: NFSD_SCOPE</changelog>
  <changelog author="nfbrown@suse.com" date="1686052800">- Add 0030-systemd-use-correct-modprobe-d-directory
  SLE15-SP5 an earlier don't use /usr/lib/modprobe.d
  (bsc#1200710)
- Add 0031-mountd-don-t-advertise-krb5-for-v4root-when-not-conf.patch
  Avoid unhelpful warning if rpcsec_gss_krb5.ko not installed</changelog>
  <changelog author="nfbrown@suse.com" date="1687867200">- Add 0032-exportfs-Ingnore-export-failures-in-nfs-server.seriv.patch
  Inconsistencies in /etc/exports shouldn't be fatal.
  (bsc#1212594)</changelog>
</package>
<package pkgid="4bde9e6d6934aa3d28c5d16309bffae675e6ad48f98285d9fac2ebd7c6685ec5" name="nfs-client" arch="x86_64">
  <version epoch="0" ver="2.1.1" rel="150500.22.3.1"/>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
  <changelog author="nfbrown@suse.com" date="1648123200">- Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch
  Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch
  Ensure "sloppy" is added correctly for newer kernels.  Particularly
  required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels.
  (boo#1197297)</changelog>
  <changelog author="nfbrown@suse.com" date="1648814400">- Add 0023-cache.c-removed-a-couple-warning.patch
  Fix compilation with new glibc (SLE15-SP4)
  (bsc#1197788)</changelog>
  <changelog author="nfbrown@suse.com" date="1655208000">- 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch
  Ensure sysctl setting work (bsc#1199856)</changelog>
  <changelog author="nfbrown@suse.com" date="1662379200">- add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch
  Fix nfsdcltrack bug that affected non-x86 archs.
  (bsc#1202627)</changelog>
  <changelog author="nfbrown@suse.com" date="1673697600">- 0026-modprobe-avoid-error-messages-if-sbin-sysctl-fail.patch
  Avoid modprobe errors when sysctl is not installed.
  (bsc#1200710 bsc#1207022 bsc#1206781)
- 0027-nfsd-allow-server-scope-to-be-set-with-config-or-com.patch
  Add "-S scope" option to rpc.nfsd to simplify fail-over cluster
  config.
  (bsc#1203746)</changelog>
  <changelog author="nfbrown@suse.com" date="1675684800">- Rename all drop-in options.conf files as 10-options.conf
  This makes it easier for other packages to over-ride
  with a drop-in with a later sequence number.
  resource-agents does this.
  (bsc#1207843)</changelog>
  <changelog author="nfbrown@suse.com" date="1680091200">- Add 0028-mount.nfs-always-include-mountpoint-or-spec-if-error.patch
  boo#1157881
- Add 0029-nfsd.man-fix-typo-in-section-on-scope.patch
  bsc#1209859
- Allow scope to be set in sysconfig: NFSD_SCOPE</changelog>
  <changelog author="nfbrown@suse.com" date="1686052800">- Add 0030-systemd-use-correct-modprobe-d-directory
  SLE15-SP5 an earlier don't use /usr/lib/modprobe.d
  (bsc#1200710)
- Add 0031-mountd-don-t-advertise-krb5-for-v4root-when-not-conf.patch
  Avoid unhelpful warning if rpcsec_gss_krb5.ko not installed</changelog>
  <changelog author="nfbrown@suse.com" date="1687867200">- Add 0032-exportfs-Ingnore-export-failures-in-nfs-server.seriv.patch
  Inconsistencies in /etc/exports shouldn't be fatal.
  (bsc#1212594)</changelog>
</package>
<package pkgid="f6ddd3f48b416ef7a9cd78b0c4063a45367d1afb6b5d0ab9397d1ef0b389fd9c" name="nfs-kernel-server" arch="aarch64">
  <version epoch="0" ver="2.1.1" rel="150500.22.3.1"/>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
  <changelog author="nfbrown@suse.com" date="1648123200">- Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch
  Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch
  Ensure "sloppy" is added correctly for newer kernels.  Particularly
  required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels.
  (boo#1197297)</changelog>
  <changelog author="nfbrown@suse.com" date="1648814400">- Add 0023-cache.c-removed-a-couple-warning.patch
  Fix compilation with new glibc (SLE15-SP4)
  (bsc#1197788)</changelog>
  <changelog author="nfbrown@suse.com" date="1655208000">- 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch
  Ensure sysctl setting work (bsc#1199856)</changelog>
  <changelog author="nfbrown@suse.com" date="1662379200">- add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch
  Fix nfsdcltrack bug that affected non-x86 archs.
  (bsc#1202627)</changelog>
  <changelog author="nfbrown@suse.com" date="1673697600">- 0026-modprobe-avoid-error-messages-if-sbin-sysctl-fail.patch
  Avoid modprobe errors when sysctl is not installed.
  (bsc#1200710 bsc#1207022 bsc#1206781)
- 0027-nfsd-allow-server-scope-to-be-set-with-config-or-com.patch
  Add "-S scope" option to rpc.nfsd to simplify fail-over cluster
  config.
  (bsc#1203746)</changelog>
  <changelog author="nfbrown@suse.com" date="1675684800">- Rename all drop-in options.conf files as 10-options.conf
  This makes it easier for other packages to over-ride
  with a drop-in with a later sequence number.
  resource-agents does this.
  (bsc#1207843)</changelog>
  <changelog author="nfbrown@suse.com" date="1680091200">- Add 0028-mount.nfs-always-include-mountpoint-or-spec-if-error.patch
  boo#1157881
- Add 0029-nfsd.man-fix-typo-in-section-on-scope.patch
  bsc#1209859
- Allow scope to be set in sysconfig: NFSD_SCOPE</changelog>
  <changelog author="nfbrown@suse.com" date="1686052800">- Add 0030-systemd-use-correct-modprobe-d-directory
  SLE15-SP5 an earlier don't use /usr/lib/modprobe.d
  (bsc#1200710)
- Add 0031-mountd-don-t-advertise-krb5-for-v4root-when-not-conf.patch
  Avoid unhelpful warning if rpcsec_gss_krb5.ko not installed</changelog>
  <changelog author="nfbrown@suse.com" date="1687867200">- Add 0032-exportfs-Ingnore-export-failures-in-nfs-server.seriv.patch
  Inconsistencies in /etc/exports shouldn't be fatal.
  (bsc#1212594)</changelog>
</package>
<package pkgid="92789ee536199f5fc6b6667083fb8e98c6bf8ecabc791e3bfc6bff2bc1fc5382" name="nfs-kernel-server" arch="s390x">
  <version epoch="0" ver="2.1.1" rel="150500.22.3.1"/>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
  <changelog author="nfbrown@suse.com" date="1648123200">- Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch
  Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch
  Ensure "sloppy" is added correctly for newer kernels.  Particularly
  required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels.
  (boo#1197297)</changelog>
  <changelog author="nfbrown@suse.com" date="1648814400">- Add 0023-cache.c-removed-a-couple-warning.patch
  Fix compilation with new glibc (SLE15-SP4)
  (bsc#1197788)</changelog>
  <changelog author="nfbrown@suse.com" date="1655208000">- 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch
  Ensure sysctl setting work (bsc#1199856)</changelog>
  <changelog author="nfbrown@suse.com" date="1662379200">- add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch
  Fix nfsdcltrack bug that affected non-x86 archs.
  (bsc#1202627)</changelog>
  <changelog author="nfbrown@suse.com" date="1673697600">- 0026-modprobe-avoid-error-messages-if-sbin-sysctl-fail.patch
  Avoid modprobe errors when sysctl is not installed.
  (bsc#1200710 bsc#1207022 bsc#1206781)
- 0027-nfsd-allow-server-scope-to-be-set-with-config-or-com.patch
  Add "-S scope" option to rpc.nfsd to simplify fail-over cluster
  config.
  (bsc#1203746)</changelog>
  <changelog author="nfbrown@suse.com" date="1675684800">- Rename all drop-in options.conf files as 10-options.conf
  This makes it easier for other packages to over-ride
  with a drop-in with a later sequence number.
  resource-agents does this.
  (bsc#1207843)</changelog>
  <changelog author="nfbrown@suse.com" date="1680091200">- Add 0028-mount.nfs-always-include-mountpoint-or-spec-if-error.patch
  boo#1157881
- Add 0029-nfsd.man-fix-typo-in-section-on-scope.patch
  bsc#1209859
- Allow scope to be set in sysconfig: NFSD_SCOPE</changelog>
  <changelog author="nfbrown@suse.com" date="1686052800">- Add 0030-systemd-use-correct-modprobe-d-directory
  SLE15-SP5 an earlier don't use /usr/lib/modprobe.d
  (bsc#1200710)
- Add 0031-mountd-don-t-advertise-krb5-for-v4root-when-not-conf.patch
  Avoid unhelpful warning if rpcsec_gss_krb5.ko not installed</changelog>
  <changelog author="nfbrown@suse.com" date="1687867200">- Add 0032-exportfs-Ingnore-export-failures-in-nfs-server.seriv.patch
  Inconsistencies in /etc/exports shouldn't be fatal.
  (bsc#1212594)</changelog>
</package>
<package pkgid="961612894aac14ca813daa362af927139fb7d64bfd030b3222643c26eee488cb" name="nfs-kernel-server" arch="x86_64">
  <version epoch="0" ver="2.1.1" rel="150500.22.3.1"/>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
  <changelog author="nfbrown@suse.com" date="1648123200">- Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch
  Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch
  Ensure "sloppy" is added correctly for newer kernels.  Particularly
  required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels.
  (boo#1197297)</changelog>
  <changelog author="nfbrown@suse.com" date="1648814400">- Add 0023-cache.c-removed-a-couple-warning.patch
  Fix compilation with new glibc (SLE15-SP4)
  (bsc#1197788)</changelog>
  <changelog author="nfbrown@suse.com" date="1655208000">- 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch
  Ensure sysctl setting work (bsc#1199856)</changelog>
  <changelog author="nfbrown@suse.com" date="1662379200">- add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch
  Fix nfsdcltrack bug that affected non-x86 archs.
  (bsc#1202627)</changelog>
  <changelog author="nfbrown@suse.com" date="1673697600">- 0026-modprobe-avoid-error-messages-if-sbin-sysctl-fail.patch
  Avoid modprobe errors when sysctl is not installed.
  (bsc#1200710 bsc#1207022 bsc#1206781)
- 0027-nfsd-allow-server-scope-to-be-set-with-config-or-com.patch
  Add "-S scope" option to rpc.nfsd to simplify fail-over cluster
  config.
  (bsc#1203746)</changelog>
  <changelog author="nfbrown@suse.com" date="1675684800">- Rename all drop-in options.conf files as 10-options.conf
  This makes it easier for other packages to over-ride
  with a drop-in with a later sequence number.
  resource-agents does this.
  (bsc#1207843)</changelog>
  <changelog author="nfbrown@suse.com" date="1680091200">- Add 0028-mount.nfs-always-include-mountpoint-or-spec-if-error.patch
  boo#1157881
- Add 0029-nfsd.man-fix-typo-in-section-on-scope.patch
  bsc#1209859
- Allow scope to be set in sysconfig: NFSD_SCOPE</changelog>
  <changelog author="nfbrown@suse.com" date="1686052800">- Add 0030-systemd-use-correct-modprobe-d-directory
  SLE15-SP5 an earlier don't use /usr/lib/modprobe.d
  (bsc#1200710)
- Add 0031-mountd-don-t-advertise-krb5-for-v4root-when-not-conf.patch
  Avoid unhelpful warning if rpcsec_gss_krb5.ko not installed</changelog>
  <changelog author="nfbrown@suse.com" date="1687867200">- Add 0032-exportfs-Ingnore-export-failures-in-nfs-server.seriv.patch
  Inconsistencies in /etc/exports shouldn't be fatal.
  (bsc#1212594)</changelog>
</package>
<package pkgid="5c6d59c5bc22a115a911b2ac8c357fe59d0021215f482c2a6c1cf3dffe7aae8f" name="nfs-utils" arch="src">
  <version epoch="0" ver="2.1.1" rel="150500.22.3.1"/>
  <changelog author="kukuk@suse.de" date="1530878400">- Create files in /var/lib/nfs via tmpfiles.d [bsc#1100404],
  [FATE#325524]</changelog>
  <changelog author="nfbrown@suse.com" date="1543838400">- 0002-Let-systemd-know-when-rpc.statd-is-needed.patch
  0003-systemd-run-statd-notify-even-when-nfs-client-isn-t-.patch
  Fixes for systemd integration
  (bsc#1116221)
- nfs.conf: spell NFSV4LEASETIME correctly.
  (bsc#1098532)</changelog>
  <changelog author="nfbrown@suse.com" date="1569844800">- Don't make /var/lib/nfs owned by statd.
  Only sm and sm.bak need to be accessible by
  statd or sm-notify after they drop privs.
  Providing they get created, the parent
  directory can be root-owned.
- 0007-statd-user-from-sm
  Change rpc.statd and sm-notify to take uid from the sm
  directory.
  (bsc#1150733 CVE-2019-3689)</changelog>
  <changelog author="nfbrown@suse.com" date="1594296000">- 0008-gssd-replace-non-thread-safe-strtok-with-strsep.patch
  Fix bug with concurrent gssd requests arriving from kernel.
  (bsc#1174260)</changelog>
  <changelog author="nfbrown@suse.com" date="1599134400">- 0009-Convert-remaining-python-scripts-to-python3.patch
  Python is no longer installed by default and these scripts
  work with python3, so request that explicitly.
  (bsc#1173104)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068800">- Add 0010-gssd-Fix-locking-for-machine-principal-list.patch
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068801">- Add 0011-manpage-Add-a-description-of-the-nconnect-mount-opti.patch
  (bsc#1181651)</changelog>
  <changelog author="nfbrown@suse.com" date="1616068802">- 0012-mountd-reject-unknown-client-IP-when-use_ipaddr.patch
  0013-mountd-Don-t-proactively-add-export-info-when-fh-inf.patch
  0014-mountd-add-logging-for-authentication-results-for-ac.patch
  0015-mountd-add-cache-use-ipaddr-option-to-force-use_ipad.patch
  0116-mountd-make-default-ttl-settable-by-option.patch
  Improve logging of authentication (bsc#1181540)</changelog>
  <changelog author="nfbrown@suse.com" date="1620388800">- Add 0018-Replace-all-var-run-with-run.patch
  /var/run is long deprecated - switch all relevant paths to /run
  (bsc#1185170)</changelog>
  <changelog author="nfbrown@suse.com" date="1621598400">- Add 0019-gssd-use-mutex-to-protect-decrement-of-refcount.patch
  A field was modified by multiple threads without locking.
  This can lead to use-after-free.
  (bsc#1183194)</changelog>
  <changelog author="nfbrown@suse.com" date="1642507200">- Add 0020-mountd-Initialize-logging-early.patch
  If an error or warning message is produced before
  closeall() is called, mountd gets confused and doesn't work.
  (bsc#1194661)</changelog>
  <changelog author="nfbrown@suse.com" date="1648123200">- Add 0021-mount.nfs-insert-sloppy-at-beginning-of-the-options.patch
  Add 0022-mount.nfs-Fix-the-sloppy-option-processing.patch
  Ensure "sloppy" is added correctly for newer kernels.  Particularly
  required for kernels since 5.6 (so SLE15-SP4), and safe for all kernels.
  (boo#1197297)</changelog>
  <changelog author="nfbrown@suse.com" date="1648814400">- Add 0023-cache.c-removed-a-couple-warning.patch
  Fix compilation with new glibc (SLE15-SP4)
  (bsc#1197788)</changelog>
  <changelog author="nfbrown@suse.com" date="1655208000">- 0024-systemd-Apply-all-sysctl-settings-when-NFS-related-m.patch
  Ensure sysctl setting work (bsc#1199856)</changelog>
  <changelog author="nfbrown@suse.com" date="1662379200">- add 0025-nfsdcltrack-getopt_long-fails-on-a-non-x86_64-archs.patch
  Fix nfsdcltrack bug that affected non-x86 archs.
  (bsc#1202627)</changelog>
  <changelog author="nfbrown@suse.com" date="1673697600">- 0026-modprobe-avoid-error-messages-if-sbin-sysctl-fail.patch
  Avoid modprobe errors when sysctl is not installed.
  (bsc#1200710 bsc#1207022 bsc#1206781)
- 0027-nfsd-allow-server-scope-to-be-set-with-config-or-com.patch
  Add "-S scope" option to rpc.nfsd to simplify fail-over cluster
  config.
  (bsc#1203746)</changelog>
  <changelog author="nfbrown@suse.com" date="1675684800">- Rename all drop-in options.conf files as 10-options.conf
  This makes it easier for other packages to over-ride
  with a drop-in with a later sequence number.
  resource-agents does this.
  (bsc#1207843)</changelog>
  <changelog author="nfbrown@suse.com" date="1680091200">- Add 0028-mount.nfs-always-include-mountpoint-or-spec-if-error.patch
  boo#1157881
- Add 0029-nfsd.man-fix-typo-in-section-on-scope.patch
  bsc#1209859
- Allow scope to be set in sysconfig: NFSD_SCOPE</changelog>
  <changelog author="nfbrown@suse.com" date="1686052800">- Add 0030-systemd-use-correct-modprobe-d-directory
  SLE15-SP5 an earlier don't use /usr/lib/modprobe.d
  (bsc#1200710)
- Add 0031-mountd-don-t-advertise-krb5-for-v4root-when-not-conf.patch
  Avoid unhelpful warning if rpcsec_gss_krb5.ko not installed</changelog>
  <changelog author="nfbrown@suse.com" date="1687867200">- Add 0032-exportfs-Ingnore-export-failures-in-nfs-server.seriv.patch
  Inconsistencies in /etc/exports shouldn't be fatal.
  (bsc#1212594)</changelog>
</package>
<package pkgid="9a698f8dcc67d8b37293a5bfa9420cd3c27d50af72a108e51187cfb6819fa746" name="nghttp2" arch="src">
  <version epoch="0" ver="1.40.0" rel="150200.12.1"/>
  <changelog author="mpluskal@suse.com" date="1515153600">- Update to version 1.29.0:
  * lib: Use NGHTTP2_REFUSED_STREAM for streams which are closed by
    GOAWAY
  * build: Remove SPDY
  * build: Fix CMAKE_MODULE_PATH
  * nghttpx: Revert "nghttpx: Use an existing h2 backend connection
    as much as possible"
  * nghttpx: Write API request body in temporary file
  * nghttpx: Increase api-max-request-body
  * nghttpx: Faster configuration loading with lots of backends
  * nghttpx: Fix crash with --backend-http-proxy-uri option</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="tchvatal@suse.com" date="1523275200">- Drop spdylay dependency as it is deprecated since version 1.28.0
  and removed from cofnigure.ac since 1.29.0</changelog>
  <changelog author="tchvatal@suse.com" date="1523275201">- Version update to 1.31.0:
  * lib: Add nghttp2_session_set_user_data() public API function (GH-1137)
  * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128)
  * nghttpx: Close listening socket on graceful shutdown
  * nghttpx: Add an option to accept expired client certificate (GH-1126)
  * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123)
  * nghttpx: Fix potential memory leak
  * lib: Allow PING frame to be sent after GOAWAY (GH-1103)
  * nghttpx: Fix bug that h1 backend idle timeout expires sooner
  * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119)
  * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099)
  * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094)
  * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101)</changelog>
  <changelog author="tchvatal@suse.com" date="1523620800">- Version umpdate to 1.31.1:
  * Fix bsc#1088639 CVE-2018-1000168
  * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/</changelog>
  <changelog author="mpluskal@suse.com" date="1531137600">- Update to version 1.32.0:
  * lib: Ignore all input after calling session_terminate_session
  * lib: Fix treatment of padding
  * lib: Don't allow 101 HTTP status code because HTTP/2 removes
    HTTP Upgrade
  * build: add ENABLE_STATIC_LIB option to build static lib
  * third-party: Upgrade neverbleed to the latest master
  * asio: Support client side SNI
  * src: Compile with libressl 2.7.2
  * src: Allow building without NPN
  * h2load: -r and --duration are mutually exclusive</changelog>
  <changelog author="adam.majer@suse.de" date="1537963200">- Update to version 1.33.0:
  * lib: Tweak nghttp2_session_set_stream_user_data
  * lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS.
  * lib: Implement ORIGIN frame
  * asio: support definition of local endpoint for cleartext
    client session
  * integration: Remove remaining SPDY code from the integration tests
  * nghttpx: Fix worker process crash with neverbleed write error
  * nghttpx: Support per-backend mruby script
  * nghttpx: Fix stream reset if data from client is arrived before
    dconn is attached</changelog>
  <changelog author="adam.majer@suse.de" date="1539000000">- Update to version 1.34.0: (bsc#1112438, FATE#326776)
  * lib: Implement RFC 8441 :protocol support
  * nghttpx: Add read/write-timeout parameters to backend option
  * nghttpx: Fix mruby parameter validation in backend option
  * nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2
  * nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues
  * nghttpx: Update mruby 1.4.1
  * nghttpx: Add mruby env.tls_handshake_finished
  * nghttpx: Add --tls13-ciphers and --tls-client-ciphers options
  * nghttpx: Add RFC 8470 Early-Data header field support
  * nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support</changelog>
  <changelog author="mpluskal@suse.com" date="1547208000">- Update to version 1.35.1:
  * nghttpx: Fix broken trailing slash handling (GH-1276)
- Changes for version 1.35:
  * build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238)
  * lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222)
  * src: Require C++14 language feature
  * nghttpx: Write mruby send_info early
  * nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend
  * h2load: Handle HTTP/1 non-final response (GH-1259)
  * h2load: Clarify that time for connect includes TLS handshake</changelog>
  <changelog author="tchvatal@suse.com" date="1547812800">- Use multibuild to not pull in python3 in first build, nghttp2
  is low in the system</changelog>
  <changelog author="seanlew@opensuse.org" date="1547812801">- Update to 1.36.0
  * build: disable shared library if ENABLE_SHARED_LIB is off
  * third-party: use http-parser to v2.9.0 (GH-1294)
  * third-party: Update mruby to 2.0.0
  * nghttpx: Pool h1 backend connection per address (GH-1292)
  * nghttpx: Randomize backend address round robin order per thread
    (GH-1291)
  * nghttpx: Fix getting long SNs for openssl &lt; 1.1 (GH-1287)
  * h2load: add an option to write per-request logs (GH-1256)
  * asio: added access to # of the current server port (GH-1257)</changelog>
  <changelog author="tchvatal@suse.com" date="1557489600">- Update to 1.38.0:
  * This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry.
  * It also fixes the bug that HTTP/1.1 chunked request stalls.
  * Now nghttpx does not log authorization request header field value with -LINFO.
  * This release fixes possible backend stall when header and request body are sent in their own packets.
  * The backend option gets weight parameter to influence backend selection.
  * This release fixes compile error with BoringSSL.
- Add patch from upstream to build with new boost bsc#1134616:
  * boost170.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1565697600">- Update to version 1.39.1:
  * This release fixes the bug that log-level is not set with
    cmd-line or configuration file. It also fixes FPE with default
    backend.
- Changes for version 1.39.0:
  * libnghttp2 now ignores content-length in 200 response to
    CONNECT request as per RFC 7230.
  * mruby has been upgraded to 2.0.1.
  * libnghttp2-asio now supports boost-1.70.
  * http-parser has been replaced with llhttp.
  * nghttpx now ignores Content-Length and Transfer-Encoding in 1xx
    or 200 to CONNECT.
- Drop no longer needed boost170.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1566216000">- Update to version 1.39.2 (bsc#1146184, bsc#1146182):
  * This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513
  “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2
  frames cause Denial of Service by consuming CPU time. Check out
  https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
  for details. For nghttpx, additionally limiting inbound traffic by
  - -read-rate and --read-burst options is quite effective against
  this kind of attack.
  * Add nghttp2_option_set_max_outbound_ack API function
  * nghttpx: Fix request stall</changelog>
  <changelog author="mpluskal@suse.com" date="1566216001">- Require correct library from devel package - boo#1125689</changelog>
  <changelog author="mpluskal@suse.com" date="1567166400">- Conditionally remove dependecy on jemalloc for SLE-12</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579003200">- Update to version 1.40.0 to fix CVE-2019-18802 in envoy-proxy and
  cilium-proxy (bsc#1166481)
  * lib: Add nghttp2_check_authority as public API
  * lib: Fix the bug that stream is closed with wrong error code
  * lib: Faster huffman encoding and decoding
  * build: Avoid filename collision of static and dynamic lib
  * build: Add new flag ENABLE_STATIC_CRT for Windows
  * build: cmake: Support building nghttpx with systemd
  * third-party: Update neverbleed to fix memory leak
  * nghttpx: Fix bug that mruby is incorrectly shared between
    backends
  * nghttpx: Reconnect h1 backend if it lost connection before
    sending headers
  * nghttpx: Returns 408 if backend timed out before sending
    headers
  * nghttpx: Fix request stal</changelog>
  <changelog author="pgajdos@suse.com" date="1615550400">- security update
- added patches
  fix CVE-2020-11080 [bsc#1181358], HTTP/2 Large Settings Frame DoS
  + nghttp2-CVE-2020-11080.patch</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1695729600">- Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be
  sent, and nghttp2_on_stream_close_callback fails with a fatal error.
  [CVE-2023-35945 bsc#1215713]
  + nghttp2-CVE-2023-35945.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1697716800">- security update
- added patches
  fix CVE-2023-44487 [bsc#1216123], HTTP/2 Rapid Reset Attack
  + nghttp2-CVE-2023-44487.patch</changelog>
</package>
<package pkgid="fc44b45cd1919a729d4eb44ecb31d35175e57fdf0525e12669acfe067950da11" name="nghttp2" arch="src">
  <version epoch="0" ver="1.40.0" rel="150200.9.1"/>
  <changelog author="dimstar@opensuse.org" date="1512993600">- Export PYTHON=/usr/bin/python3 before running configure: allow to
  build without (comnplete) python2 in the buildroot. In any case
  we only ship python3-bindings already.</changelog>
  <changelog author="mpluskal@suse.com" date="1515153600">- Update to version 1.29.0:
  * lib: Use NGHTTP2_REFUSED_STREAM for streams which are closed by
    GOAWAY
  * build: Remove SPDY
  * build: Fix CMAKE_MODULE_PATH
  * nghttpx: Revert "nghttpx: Use an existing h2 backend connection
    as much as possible"
  * nghttpx: Write API request body in temporary file
  * nghttpx: Increase api-max-request-body
  * nghttpx: Faster configuration loading with lots of backends
  * nghttpx: Fix crash with --backend-http-proxy-uri option</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="tchvatal@suse.com" date="1523275200">- Drop spdylay dependency as it is deprecated since version 1.28.0
  and removed from cofnigure.ac since 1.29.0</changelog>
  <changelog author="tchvatal@suse.com" date="1523275201">- Version update to 1.31.0:
  * lib: Add nghttp2_session_set_user_data() public API function (GH-1137)
  * src: Define nghttp2_inet_pton wrapper to avoid inet_pton macro (GH-1128)
  * nghttpx: Close listening socket on graceful shutdown
  * nghttpx: Add an option to accept expired client certificate (GH-1126)
  * nghttpx: Add mruby tls_client_not_before, and tls_client_not_after (GH-1123)
  * nghttpx: Fix potential memory leak
  * lib: Allow PING frame to be sent after GOAWAY (GH-1103)
  * nghttpx: Fix bug that h1 backend idle timeout expires sooner
  * nghttpx: Stop overwrite of first header on mruby call to env.req.set_header(..) (Patch from Dylan Plecki) (GH-1119)
  * nghttpx: Add upgrade-scheme parameter to backend option (GH-1099)
  * nghttpx: Fix missing ALPN validation (--npn-list) (GH-1094)
  * nghttpx: Remember which resource is pushed for RFC 8297 (GH-1101)</changelog>
  <changelog author="tchvatal@suse.com" date="1523620800">- Version umpdate to 1.31.1:
  * Fix bsc#1088639 CVE-2018-1000168
  * https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/</changelog>
  <changelog author="mpluskal@suse.com" date="1531137600">- Update to version 1.32.0:
  * lib: Ignore all input after calling session_terminate_session
  * lib: Fix treatment of padding
  * lib: Don't allow 101 HTTP status code because HTTP/2 removes
    HTTP Upgrade
  * build: add ENABLE_STATIC_LIB option to build static lib
  * third-party: Upgrade neverbleed to the latest master
  * asio: Support client side SNI
  * src: Compile with libressl 2.7.2
  * src: Allow building without NPN
  * h2load: -r and --duration are mutually exclusive</changelog>
  <changelog author="adam.majer@suse.de" date="1537963200">- Update to version 1.33.0:
  * lib: Tweak nghttp2_session_set_stream_user_data
  * lib: Fix handling of SETTINGS_MAX_CONCURRENT_STREAMS.
  * lib: Implement ORIGIN frame
  * asio: support definition of local endpoint for cleartext
    client session
  * integration: Remove remaining SPDY code from the integration tests
  * nghttpx: Fix worker process crash with neverbleed write error
  * nghttpx: Support per-backend mruby script
  * nghttpx: Fix stream reset if data from client is arrived before
    dconn is attached</changelog>
  <changelog author="adam.majer@suse.de" date="1539000000">- Update to version 1.34.0: (bsc#1112438, FATE#326776)
  * lib: Implement RFC 8441 :protocol support
  * nghttpx: Add read/write-timeout parameters to backend option
  * nghttpx: Fix mruby parameter validation in backend option
  * nghttpx: Implement RFC 8441 Bootstrapping WebSocket with HTTP/2
  * nghttpx: Update neverbleed to fix OpenSSL 1.1.1 issues
  * nghttpx: Update mruby 1.4.1
  * nghttpx: Add mruby env.tls_handshake_finished
  * nghttpx: Add --tls13-ciphers and --tls-client-ciphers options
  * nghttpx: Add RFC 8470 Early-Data header field support
  * nghttpx: Add RFC 8446 TLSv1.3 0-RTT early data support</changelog>
  <changelog author="mpluskal@suse.com" date="1547208000">- Update to version 1.35.1:
  * nghttpx: Fix broken trailing slash handling (GH-1276)
- Changes for version 1.35:
  * build: cmake: Fix libevent version detection (Patch from Jan Kundrát) (GH-1238)
  * lib: Use __has_declspec_attribute for shared builds (Patch from Don) (GH-1222)
  * src: Require C++14 language feature
  * nghttpx: Write mruby send_info early
  * nghttpx: Fix assertion failure on mruby send_info with HTTP/1 frontend
  * h2load: Handle HTTP/1 non-final response (GH-1259)
  * h2load: Clarify that time for connect includes TLS handshake</changelog>
  <changelog author="tchvatal@suse.com" date="1547812800">- Use multibuild to not pull in python3 in first build, nghttp2
  is low in the system</changelog>
  <changelog author="seanlew@opensuse.org" date="1547812801">- Update to 1.36.0
  * build: disable shared library if ENABLE_SHARED_LIB is off
  * third-party: use http-parser to v2.9.0 (GH-1294)
  * third-party: Update mruby to 2.0.0
  * nghttpx: Pool h1 backend connection per address (GH-1292)
  * nghttpx: Randomize backend address round robin order per thread
    (GH-1291)
  * nghttpx: Fix getting long SNs for openssl &lt; 1.1 (GH-1287)
  * h2load: add an option to write per-request logs (GH-1256)
  * asio: added access to # of the current server port (GH-1257)</changelog>
  <changelog author="tchvatal@suse.com" date="1557489600">- Update to 1.38.0:
  * This release fixes the bug that authority and path altered by per-pattern mruby script can affect backend selection on retry.
  * It also fixes the bug that HTTP/1.1 chunked request stalls.
  * Now nghttpx does not log authorization request header field value with -LINFO.
  * This release fixes possible backend stall when header and request body are sent in their own packets.
  * The backend option gets weight parameter to influence backend selection.
  * This release fixes compile error with BoringSSL.
- Add patch from upstream to build with new boost bsc#1134616:
  * boost170.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1565697600">- Update to version 1.39.1:
  * This release fixes the bug that log-level is not set with
    cmd-line or configuration file. It also fixes FPE with default
    backend.
- Changes for version 1.39.0:
  * libnghttp2 now ignores content-length in 200 response to
    CONNECT request as per RFC 7230.
  * mruby has been upgraded to 2.0.1.
  * libnghttp2-asio now supports boost-1.70.
  * http-parser has been replaced with llhttp.
  * nghttpx now ignores Content-Length and Transfer-Encoding in 1xx
    or 200 to CONNECT.
- Drop no longer needed boost170.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1566216000">- Update to version 1.39.2 (bsc#1146184, bsc#1146182):
  * This release fixes CVE-2019-9511 “Data Dribble” and CVE-2019-9513
  “Resource Loop” vulnerability in nghttpx and nghttpd. Specially crafted HTTP/2
  frames cause Denial of Service by consuming CPU time. Check out
  https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
  for details. For nghttpx, additionally limiting inbound traffic by
  - -read-rate and --read-burst options is quite effective against
  this kind of attack.
  * Add nghttp2_option_set_max_outbound_ack API function
  * nghttpx: Fix request stall</changelog>
  <changelog author="mpluskal@suse.com" date="1566216001">- Require correct library from devel package - boo#1125689</changelog>
  <changelog author="mpluskal@suse.com" date="1567166400">- Conditionally remove dependecy on jemalloc for SLE-12</changelog>
  <changelog author="mrostecki@opensuse.org" date="1579003200">- Update to version 1.40.0 to fix CVE-2019-18802 in envoy-proxy and
  cilium-proxy (bsc#1166481)
  * lib: Add nghttp2_check_authority as public API
  * lib: Fix the bug that stream is closed with wrong error code
  * lib: Faster huffman encoding and decoding
  * build: Avoid filename collision of static and dynamic lib
  * build: Add new flag ENABLE_STATIC_CRT for Windows
  * build: cmake: Support building nghttpx with systemd
  * third-party: Update neverbleed to fix memory leak
  * nghttpx: Fix bug that mruby is incorrectly shared between
    backends
  * nghttpx: Reconnect h1 backend if it lost connection before
    sending headers
  * nghttpx: Returns 408 if backend timed out before sending
    headers
  * nghttpx: Fix request stal</changelog>
  <changelog author="pgajdos@suse.com" date="1615550400">- security update
- added patches
  fix CVE-2020-11080 [bsc#1181358], HTTP/2 Large Settings Frame DoS
  + nghttp2-CVE-2020-11080.patch</changelog>
  <changelog author="valentin.lefebvre@suse.com" date="1695729600">- Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be
  sent, and nghttp2_on_stream_close_callback fails with a fatal error.
  [CVE-2023-35945 bsc#1215713]
  + nghttp2-CVE-2023-35945.patch</changelog>
</package>
<package pkgid="3e56afb4d345d0a6c07e35329500effb8bd155af029257044a99e334677f44f9" name="nvme-cli" arch="aarch64">
  <version epoch="0" ver="2.4+25.g367eb9" rel="150500.4.9.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.
- Fix version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Fix zsh completion package depenedencies.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 2.0~2:
  * Adapt to logging API changes in libnvme
  * Adapt to scan API changes in libnvme
  * Reworked error message handling
  * Fix 'list-ns' (bsc#1195151)
  * Add 'gen-tls-key' and 'check-tls-key'
  * Add Media Unit Status log page support
  * Cleanups and build fixes
- Fix path to systemctl (bsc#1193699)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v2.0-rc3:
  * nvme-print: Fix json output for list-subsys
  * nvme: Allow --verbose flag to increase log level
  * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command
  * nvmf: Remove --matching from systemd service file (bsc#1195665)
  * nvme: Fix --force flag inversion (bsc#1195637)
  * nvme: Add support for data area 4 to get-telemetry-log
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string
  * nvme-print: remove unused nvme_show_id_ctrl function
  * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095
  * nvme: Add NVM Command Set specific identify namespace command
  * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
- Include precompiled documentation</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 2.0-rc4:
  * netapp-nvme: free the nsdescs pointer after use
  * netapp-nvme: fix ontapdevices segfault in json output
  * nvme-print: fix 'nvme list -o json' segfault
  * nvme: get_ns_id command fails on nvme device
  * wdc: updated products list for telemetry (--type) argument
  * docs: fix typo in Data Set Management section
  * Fix ctrlist for attach-ns and detach-ns
  * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices
  * wdc: Fix use-after-free access of cbs_data
  * Fixed regression with 'open namespace exclusive' (bsc#1195945)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 2.0-rc5:
  * nvme: passthru bugfix(wrong jump, wrong file descriptor)
  * nvme-cli: Ignore traddr case (bsc#1194025)
  * nvme: fix segfault in nvme telemetry-log error handling
  * fabrics: ensure zero kato for non-persistent controllers
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 2.0-rc6:
  * nvme: print out ANA state for 'list-subsys' (bsc#1195938)
  * nvme: Explicit initialize all command line options (bsc#1195945)
  * nvme: Explicit initialize passthru command line options
  * nvme: list_ns bug fix (csi option enable)
  * nvme: nvme write bug fix (no parse for option)
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 2.0-rc7:
  * netapp-nvme: fix smdevices segfault in json output (bsc#1195937)
  * fabrics: keep the backward compatibility
  * nvme: Do not slash escape strings in JSON output (bsc#1195937)
  * nvme: Print full device path
  * nvme-print: Make JSON keys consistent with nvme-cli 1.x
  * nvme-print: print generic device in list command
  * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061)
  * connect: Set errno to zero on nvmf_add_ctrl() success
  * documenation updates
- Set path to systemctl via newly introduced config option
- Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename
- Moved bash completion script to /usr/share/bash-completion/completions/nvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647950400">- Fix install conflict caused by new bash completion script
  location (bsc#1197365).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 2.0-rc8:
  * fabrics: Add DIM command
  * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076)
  * fabrics: Free non-matching controller during discovery
  * fabrics: add 'nvme config' command
  * fabrics: Correctly stringify discovery.conf and config.json paths
  * nvme-print: Add human readable print for nsattr field
  * nvme-print: Update Persistent Event log fields
  * nvme-print: print discovery async event support
  * nvme-rpmb: Fix spelling for 'Partition'
  * nvme-copy: add missing field to the command
  * nvme: add get_mi_cmd_support_effects_log command
  * nvme: Fixup namespace filtering yet again
  * nvme: Use type bool for OPT_FLAG
  * nvme: use filter for 'list-subsys &lt;devname&gt;' (bsc#1195938)
  * Add lbstm option to create-ns
  * argconfig: Do not use default value loading by getopt_long_only
  * argconfig: Rename CFG_NONE to CFG_FLAG
  * plugins: Use type bool for OPT_FLAG
  * documenation updates
- Drop 'ProtectKernelTunables=true' (bsc#1197076)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 2.0:
  * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243)
  * fabrics: Set KATO for discovery controller when connecting
  * fabrics: Do no modify default config for discovery controller
  * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858)
  * fabrics: Support connect even when no /etc/nvme/hostnqn file exists
  * nvme: update to nvme_scan_filter_t modifications (bsc#1195938)
  * plugins/intel: make 'buckets' a json array
  * plugins: Update WDC capabilities command with new commmands
  * plugins: Add OCP plugin</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- fabrics: Already connected uses a different error code (bsc#1199994)
  * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
- fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994)
  * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
- nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990)
  * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
- fabrics: Honor config file for connect-all (bsc#1199504)
  * add 0005-fabrics-Honor-config-file-for-connect-all.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701)
  * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
- Fabrics related bug fixes
  * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 2.2.1 (jsc#ped-553):
  * Added parsing for Solidigm telemetry observable data.
  * Revert "udev: re-read the discovery log page when a discovery controller reconnected"
  * add item ddr_ecc_err_cnt in smart-log-add
  * build and install fixes/improvements
  * build: Add minimum build requirement on libnvme
  * build: Drop dependency on libuuid
  * build: Extend release script to support micro version releases
  * build: Fix endian check for cross build
  * build: Remove unused uuid.wrap file
  * build: Remove unusned uuid.h include
  * build: Update release version rules
  * build: Update version before regenerating docs
  * completions: Add show-topology tab completion
  * documentation fixes
  * fabrics: Avoid nvme_scan_ctrl when disconnecting
  * fabrics: Honor JSON config file in connect-all command
  * fabrics: Remove dhchap-ctrl-secret from discover/connect-all
  * fabrics: Trigger auto connect if config.json exists
  * fabrics: fix 'persistent' handling during connect-all with JSON file
  * fabrics: nvme config --modify depends on -n and -t argument
  * fabrics: re-read the discovery log page when a discovery controller reconnected
  * json: Support uint64 types serialization for older json-c versions
  * meson: we don't need a c++ compiler
  * new solidigm plugin
  * nvme, plugins: fix __u64 -&gt; unsigned long long assumptions
  * nvme-print: Add missing values in id-ctrl for JSON output
  * nvme-print: Handle NULL hostid in JSON output
  * nvme-print: Output 128bit values as uint128 type instead of double
  * nvme-print: Print fguid as a UUID
  * nvme-print: Use uint128 JSON function for media_units_written
  * nvme-print: decode MI status values
  * nvme-print: decode status types
  * nvme-print: fix wrong json key
  * nvme-print: sanitize the get-feature async event config output
  * nvme: Add helper function to parse 16-bit comma separated list
  * nvme: Add nvme_cmd wrapper for get_features
  * nvme: Add show-topology command
  * nvme: Add wrapper for Format NVM
  * nvme: Add wrapper for Sanitize NVM
  * nvme: Add wrappers for Get Log page helpers
  * nvme: Add wrappers for Identify controller lists
  * nvme: Add wrappers for NS attach/detach
  * nvme: Add wrappers for NS management functions
  * nvme: Add wrappers for basic NS identify
  * nvme: Add wrappers for firmware commands
  * nvme: Do not print error message in collect_effects_log helper
  * nvme: Fix set feature command to get feature identifier 0Dh length as zero
  * nvme: Introduce a union in struct nvme_dev for different transport types
  * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl
  * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere
  * nvme: Masks SSTAT in sanize-log output
  * nvme: Remove static nvme_dev, allocate on open instead
  * nvme: Set default rae value for nvme_get_nsid_log users
  * nvme: Simplify ns list identify
  * nvme: Use correct print format specifier for sizeof arguments
  * nvme: Use local struct nvme_dev for show_registers &amp; map_registers
  * nvme: check if cfg.metadata is NULL before passing it to strlen()
  * nvme: use helpers for checking status types
  * plugins/innogrit: Include timer.h
  * plugins/innogrit: add smart items for smart-log-add
  * plugins/micron-nvme: Use correct print format specifier for sizeof arguments
  * plugins/ocp: Include timer.h
  * plugins/ocp: Output 128bit values as uint128 type instead of double
  * plugins/ocp: drop unused fd argument
  * plugins/ocp: pass struct nvme_dev to internal functions
  * plugins/seagate: Add support for OCP
  * plugins/solidigm: fix return value on format parse failure
  * plugins/toshiba: pass struct nvme_dev rather than fd + name
  * plugins/virtium: Output 128bit values as uint128 type instead of double
  * plugins/wdc: Add support for SN660 drive
  * plugins/wdc: Add type case for feature id
  * plugins/wdc: Output 128bit values as uint128 type instead of double
  * plugins/wdc: fix memset() on the address of a pointer
  * plugins/wdc: pass a struct nvme_dev around rather than a fd
  * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev
  * plugins/wdc: prevent duplicate close on NVMe device
  * plugins/wdc: remove fd argument from print functions
  * plugins/ytmc: pass struct nvme_dev rather than fd + name
  * plugins: Use PRIu64 format specifier for 64bit types
  * print: Add Controller Ready Timeout Exceeded HW error code
  * print: Fix nvme_id_uuid_list
  * solidgm: fix initialization warning
  * solidigm: Added parsing for telemetry customer screenable data
  * solidigm: Fix printf format for size_t variable
  * solidigm: Updated Telemetry parsing code to MIT license.
  * subprojects/libnvme: update for MI admin command coverage
  * tests: Update license to GPL-2.0-or-later
  * tree: Add NVMe-MI support
  * tree: Add dev_fd() helper
  * tree: Change nvme_dev from global to static
  * tree: Combine NVMe file descriptor into struct nvme_dev
  * tree: Move global device info to a single struct
  * tree: fail on non-negative return values from parse_and_open
  * udev: Add HOST_IFACE to udev rule
  * util/json.h: Add json_object_get_uint64 fallback implementation
  * util/json: Add 128 bit JSON helpers
  * util/types: Add 128 bit conversion helpers
  * util: Fix le128_to_cpu on big-endian
  * util: Fix le128_to_cpu on little-endian
  * util: Move common type conversion helpers into util section
  * utils/json: Add json_object_new_uint64 for json-c &lt; 0.14
  * utils: Fix uint128_t usage
  * various fixes reported by coverity
  * version reporting includes library version
  * wdc:  OCP Log page updates and fixes
  * wrapper: Add weak nvme_init_copy_range_f1 symbol
  * wrapper: Call library version of nvme_init_copy_range_f1
  * wrapper: Update SPDIX license
  * zns.c: report zones should be started after retrieved zone
- Drop upsreamp patches
  * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
  * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
  * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
  * remove 0005-fabrics-Honor-config-file-for-connect-all.patch
  * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
  * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch
- Handle suse-missing-rclink lint warnings by providing the symlinks
- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- Mark no binaries rpms as noarch</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 2.2.1+3.gd028407:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Add %check section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- spec file: fix "check" section (bsc#1207686)
- add "Provides: nvmeof-boot-support = 0.1"</changelog>
  <changelog author="daniel.wagner@suse.com" date="1684929600">- Update to version v2.4 (jsc#PED-553 jsc#PED-3884)
  - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435)
  * json_discovery_log: avoid buffer overrun
  - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001)
  * udev: Add HOST_IFACE to udev rule
  - Build documentation to be up to date
  - Fix build warning (git-fixes)
  * fabrics: 'e-&gt;traddr' is static
  - Improvements for supported-log-pages (bsc#1209550)
  * nvme-doc: update man page for supported-log-pages
  * nvme-print: sanitize supported-log-pages output
  - Fix read command (bsc#1209564)
  * nvme: fix block count and data size logic
  - Fix mounting filesystems via fstab (bsc#1208075)
  * fabrics: Fix ordering for auto connect services
  - Update host_traddr when using config.json file (bsc#1210089)
  * fabrics: fix fc config JSON file handling
  - remove 0100-harden_nvmf-connect@.service.patch
- Added compat commands for nbft back
- Changed default behavior of connect-all to match with old nbft
  behavior
- Replaced old nbft implementation with upstream one
- Rebuild documentation on package update
- Set version-tag so that version are correctly reported
- Fix connect nbft regressions (bsc#1209905)
  * fabrics: fix argc in show_nbft_compat_cmd()
- Fix auto connect conditions (bsc#1210105)
  * fabrics: fix conditions in nvmf-autoconnect.service
- Fix auto boot for NBFT connections (bsc#1211647)
  * fabrics: add udev rule to avoid renaming nbft interfaces
  * fabrics: autoconnect: add service unit for connecting NBFT subsystems</changelog>
  <changelog author="dwagner@suse.de" date="1690459200">- Update to version 2.4+24.ga1ee20:
  * nvme-print-stdout: Do not show non reachable ns in namespace topology (bsc#1212598)
  * nvme-print-stdout: List only ctrls which are part of ns bsc#1212598)
  * nvme-print-stdout: Support subsys reachable from several hosts bsc#1212598)
  * ccan: Add htable, strset and dependencies bsc#1212598)
  * ccan: Remove unused documentation bsc#1212598)
  * nvme-print: fix counter while looping through uuid_list (bsc#bsc#1212598)
  * nvme-print: Show subsystem iopolicy (bsc#1124564)</changelog>
  <changelog author="dwagner@suse.de" date="1693915200">- Update to version 2.4+25.g367eb9:
  * json: fix seg. fault converting NULL to JSON string (bsc#1213762)</changelog>
</package>
<package pkgid="a8ec7bfe1eb51e2b1ae97558ee9863fbad1e0030b96b104ba254b0b4104434f2" name="nvme-cli" arch="s390x">
  <version epoch="0" ver="2.4+25.g367eb9" rel="150500.4.9.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.
- Fix version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Fix zsh completion package depenedencies.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 2.0~2:
  * Adapt to logging API changes in libnvme
  * Adapt to scan API changes in libnvme
  * Reworked error message handling
  * Fix 'list-ns' (bsc#1195151)
  * Add 'gen-tls-key' and 'check-tls-key'
  * Add Media Unit Status log page support
  * Cleanups and build fixes
- Fix path to systemctl (bsc#1193699)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v2.0-rc3:
  * nvme-print: Fix json output for list-subsys
  * nvme: Allow --verbose flag to increase log level
  * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command
  * nvmf: Remove --matching from systemd service file (bsc#1195665)
  * nvme: Fix --force flag inversion (bsc#1195637)
  * nvme: Add support for data area 4 to get-telemetry-log
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string
  * nvme-print: remove unused nvme_show_id_ctrl function
  * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095
  * nvme: Add NVM Command Set specific identify namespace command
  * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
- Include precompiled documentation</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 2.0-rc4:
  * netapp-nvme: free the nsdescs pointer after use
  * netapp-nvme: fix ontapdevices segfault in json output
  * nvme-print: fix 'nvme list -o json' segfault
  * nvme: get_ns_id command fails on nvme device
  * wdc: updated products list for telemetry (--type) argument
  * docs: fix typo in Data Set Management section
  * Fix ctrlist for attach-ns and detach-ns
  * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices
  * wdc: Fix use-after-free access of cbs_data
  * Fixed regression with 'open namespace exclusive' (bsc#1195945)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 2.0-rc5:
  * nvme: passthru bugfix(wrong jump, wrong file descriptor)
  * nvme-cli: Ignore traddr case (bsc#1194025)
  * nvme: fix segfault in nvme telemetry-log error handling
  * fabrics: ensure zero kato for non-persistent controllers
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 2.0-rc6:
  * nvme: print out ANA state for 'list-subsys' (bsc#1195938)
  * nvme: Explicit initialize all command line options (bsc#1195945)
  * nvme: Explicit initialize passthru command line options
  * nvme: list_ns bug fix (csi option enable)
  * nvme: nvme write bug fix (no parse for option)
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 2.0-rc7:
  * netapp-nvme: fix smdevices segfault in json output (bsc#1195937)
  * fabrics: keep the backward compatibility
  * nvme: Do not slash escape strings in JSON output (bsc#1195937)
  * nvme: Print full device path
  * nvme-print: Make JSON keys consistent with nvme-cli 1.x
  * nvme-print: print generic device in list command
  * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061)
  * connect: Set errno to zero on nvmf_add_ctrl() success
  * documenation updates
- Set path to systemctl via newly introduced config option
- Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename
- Moved bash completion script to /usr/share/bash-completion/completions/nvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647950400">- Fix install conflict caused by new bash completion script
  location (bsc#1197365).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 2.0-rc8:
  * fabrics: Add DIM command
  * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076)
  * fabrics: Free non-matching controller during discovery
  * fabrics: add 'nvme config' command
  * fabrics: Correctly stringify discovery.conf and config.json paths
  * nvme-print: Add human readable print for nsattr field
  * nvme-print: Update Persistent Event log fields
  * nvme-print: print discovery async event support
  * nvme-rpmb: Fix spelling for 'Partition'
  * nvme-copy: add missing field to the command
  * nvme: add get_mi_cmd_support_effects_log command
  * nvme: Fixup namespace filtering yet again
  * nvme: Use type bool for OPT_FLAG
  * nvme: use filter for 'list-subsys &lt;devname&gt;' (bsc#1195938)
  * Add lbstm option to create-ns
  * argconfig: Do not use default value loading by getopt_long_only
  * argconfig: Rename CFG_NONE to CFG_FLAG
  * plugins: Use type bool for OPT_FLAG
  * documenation updates
- Drop 'ProtectKernelTunables=true' (bsc#1197076)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 2.0:
  * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243)
  * fabrics: Set KATO for discovery controller when connecting
  * fabrics: Do no modify default config for discovery controller
  * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858)
  * fabrics: Support connect even when no /etc/nvme/hostnqn file exists
  * nvme: update to nvme_scan_filter_t modifications (bsc#1195938)
  * plugins/intel: make 'buckets' a json array
  * plugins: Update WDC capabilities command with new commmands
  * plugins: Add OCP plugin</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- fabrics: Already connected uses a different error code (bsc#1199994)
  * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
- fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994)
  * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
- nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990)
  * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
- fabrics: Honor config file for connect-all (bsc#1199504)
  * add 0005-fabrics-Honor-config-file-for-connect-all.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701)
  * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
- Fabrics related bug fixes
  * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 2.2.1 (jsc#ped-553):
  * Added parsing for Solidigm telemetry observable data.
  * Revert "udev: re-read the discovery log page when a discovery controller reconnected"
  * add item ddr_ecc_err_cnt in smart-log-add
  * build and install fixes/improvements
  * build: Add minimum build requirement on libnvme
  * build: Drop dependency on libuuid
  * build: Extend release script to support micro version releases
  * build: Fix endian check for cross build
  * build: Remove unused uuid.wrap file
  * build: Remove unusned uuid.h include
  * build: Update release version rules
  * build: Update version before regenerating docs
  * completions: Add show-topology tab completion
  * documentation fixes
  * fabrics: Avoid nvme_scan_ctrl when disconnecting
  * fabrics: Honor JSON config file in connect-all command
  * fabrics: Remove dhchap-ctrl-secret from discover/connect-all
  * fabrics: Trigger auto connect if config.json exists
  * fabrics: fix 'persistent' handling during connect-all with JSON file
  * fabrics: nvme config --modify depends on -n and -t argument
  * fabrics: re-read the discovery log page when a discovery controller reconnected
  * json: Support uint64 types serialization for older json-c versions
  * meson: we don't need a c++ compiler
  * new solidigm plugin
  * nvme, plugins: fix __u64 -&gt; unsigned long long assumptions
  * nvme-print: Add missing values in id-ctrl for JSON output
  * nvme-print: Handle NULL hostid in JSON output
  * nvme-print: Output 128bit values as uint128 type instead of double
  * nvme-print: Print fguid as a UUID
  * nvme-print: Use uint128 JSON function for media_units_written
  * nvme-print: decode MI status values
  * nvme-print: decode status types
  * nvme-print: fix wrong json key
  * nvme-print: sanitize the get-feature async event config output
  * nvme: Add helper function to parse 16-bit comma separated list
  * nvme: Add nvme_cmd wrapper for get_features
  * nvme: Add show-topology command
  * nvme: Add wrapper for Format NVM
  * nvme: Add wrapper for Sanitize NVM
  * nvme: Add wrappers for Get Log page helpers
  * nvme: Add wrappers for Identify controller lists
  * nvme: Add wrappers for NS attach/detach
  * nvme: Add wrappers for NS management functions
  * nvme: Add wrappers for basic NS identify
  * nvme: Add wrappers for firmware commands
  * nvme: Do not print error message in collect_effects_log helper
  * nvme: Fix set feature command to get feature identifier 0Dh length as zero
  * nvme: Introduce a union in struct nvme_dev for different transport types
  * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl
  * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere
  * nvme: Masks SSTAT in sanize-log output
  * nvme: Remove static nvme_dev, allocate on open instead
  * nvme: Set default rae value for nvme_get_nsid_log users
  * nvme: Simplify ns list identify
  * nvme: Use correct print format specifier for sizeof arguments
  * nvme: Use local struct nvme_dev for show_registers &amp; map_registers
  * nvme: check if cfg.metadata is NULL before passing it to strlen()
  * nvme: use helpers for checking status types
  * plugins/innogrit: Include timer.h
  * plugins/innogrit: add smart items for smart-log-add
  * plugins/micron-nvme: Use correct print format specifier for sizeof arguments
  * plugins/ocp: Include timer.h
  * plugins/ocp: Output 128bit values as uint128 type instead of double
  * plugins/ocp: drop unused fd argument
  * plugins/ocp: pass struct nvme_dev to internal functions
  * plugins/seagate: Add support for OCP
  * plugins/solidigm: fix return value on format parse failure
  * plugins/toshiba: pass struct nvme_dev rather than fd + name
  * plugins/virtium: Output 128bit values as uint128 type instead of double
  * plugins/wdc: Add support for SN660 drive
  * plugins/wdc: Add type case for feature id
  * plugins/wdc: Output 128bit values as uint128 type instead of double
  * plugins/wdc: fix memset() on the address of a pointer
  * plugins/wdc: pass a struct nvme_dev around rather than a fd
  * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev
  * plugins/wdc: prevent duplicate close on NVMe device
  * plugins/wdc: remove fd argument from print functions
  * plugins/ytmc: pass struct nvme_dev rather than fd + name
  * plugins: Use PRIu64 format specifier for 64bit types
  * print: Add Controller Ready Timeout Exceeded HW error code
  * print: Fix nvme_id_uuid_list
  * solidgm: fix initialization warning
  * solidigm: Added parsing for telemetry customer screenable data
  * solidigm: Fix printf format for size_t variable
  * solidigm: Updated Telemetry parsing code to MIT license.
  * subprojects/libnvme: update for MI admin command coverage
  * tests: Update license to GPL-2.0-or-later
  * tree: Add NVMe-MI support
  * tree: Add dev_fd() helper
  * tree: Change nvme_dev from global to static
  * tree: Combine NVMe file descriptor into struct nvme_dev
  * tree: Move global device info to a single struct
  * tree: fail on non-negative return values from parse_and_open
  * udev: Add HOST_IFACE to udev rule
  * util/json.h: Add json_object_get_uint64 fallback implementation
  * util/json: Add 128 bit JSON helpers
  * util/types: Add 128 bit conversion helpers
  * util: Fix le128_to_cpu on big-endian
  * util: Fix le128_to_cpu on little-endian
  * util: Move common type conversion helpers into util section
  * utils/json: Add json_object_new_uint64 for json-c &lt; 0.14
  * utils: Fix uint128_t usage
  * various fixes reported by coverity
  * version reporting includes library version
  * wdc:  OCP Log page updates and fixes
  * wrapper: Add weak nvme_init_copy_range_f1 symbol
  * wrapper: Call library version of nvme_init_copy_range_f1
  * wrapper: Update SPDIX license
  * zns.c: report zones should be started after retrieved zone
- Drop upsreamp patches
  * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
  * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
  * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
  * remove 0005-fabrics-Honor-config-file-for-connect-all.patch
  * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
  * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch
- Handle suse-missing-rclink lint warnings by providing the symlinks
- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- Mark no binaries rpms as noarch</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 2.2.1+3.gd028407:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Add %check section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- spec file: fix "check" section (bsc#1207686)
- add "Provides: nvmeof-boot-support = 0.1"</changelog>
  <changelog author="daniel.wagner@suse.com" date="1684929600">- Update to version v2.4 (jsc#PED-553 jsc#PED-3884)
  - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435)
  * json_discovery_log: avoid buffer overrun
  - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001)
  * udev: Add HOST_IFACE to udev rule
  - Build documentation to be up to date
  - Fix build warning (git-fixes)
  * fabrics: 'e-&gt;traddr' is static
  - Improvements for supported-log-pages (bsc#1209550)
  * nvme-doc: update man page for supported-log-pages
  * nvme-print: sanitize supported-log-pages output
  - Fix read command (bsc#1209564)
  * nvme: fix block count and data size logic
  - Fix mounting filesystems via fstab (bsc#1208075)
  * fabrics: Fix ordering for auto connect services
  - Update host_traddr when using config.json file (bsc#1210089)
  * fabrics: fix fc config JSON file handling
  - remove 0100-harden_nvmf-connect@.service.patch
- Added compat commands for nbft back
- Changed default behavior of connect-all to match with old nbft
  behavior
- Replaced old nbft implementation with upstream one
- Rebuild documentation on package update
- Set version-tag so that version are correctly reported
- Fix connect nbft regressions (bsc#1209905)
  * fabrics: fix argc in show_nbft_compat_cmd()
- Fix auto connect conditions (bsc#1210105)
  * fabrics: fix conditions in nvmf-autoconnect.service
- Fix auto boot for NBFT connections (bsc#1211647)
  * fabrics: add udev rule to avoid renaming nbft interfaces
  * fabrics: autoconnect: add service unit for connecting NBFT subsystems</changelog>
  <changelog author="dwagner@suse.de" date="1690459200">- Update to version 2.4+24.ga1ee20:
  * nvme-print-stdout: Do not show non reachable ns in namespace topology (bsc#1212598)
  * nvme-print-stdout: List only ctrls which are part of ns bsc#1212598)
  * nvme-print-stdout: Support subsys reachable from several hosts bsc#1212598)
  * ccan: Add htable, strset and dependencies bsc#1212598)
  * ccan: Remove unused documentation bsc#1212598)
  * nvme-print: fix counter while looping through uuid_list (bsc#bsc#1212598)
  * nvme-print: Show subsystem iopolicy (bsc#1124564)</changelog>
  <changelog author="dwagner@suse.de" date="1693915200">- Update to version 2.4+25.g367eb9:
  * json: fix seg. fault converting NULL to JSON string (bsc#1213762)</changelog>
</package>
<package pkgid="2ae828163a748d48a77c98dbcb2663b19ea0cea430b9d3a4ec66c96d868ae075" name="nvme-cli" arch="src">
  <version epoch="0" ver="2.4+25.g367eb9" rel="150500.4.9.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.
- Fix version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Fix zsh completion package depenedencies.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 2.0~2:
  * Adapt to logging API changes in libnvme
  * Adapt to scan API changes in libnvme
  * Reworked error message handling
  * Fix 'list-ns' (bsc#1195151)
  * Add 'gen-tls-key' and 'check-tls-key'
  * Add Media Unit Status log page support
  * Cleanups and build fixes
- Fix path to systemctl (bsc#1193699)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v2.0-rc3:
  * nvme-print: Fix json output for list-subsys
  * nvme: Allow --verbose flag to increase log level
  * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command
  * nvmf: Remove --matching from systemd service file (bsc#1195665)
  * nvme: Fix --force flag inversion (bsc#1195637)
  * nvme: Add support for data area 4 to get-telemetry-log
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string
  * nvme-print: remove unused nvme_show_id_ctrl function
  * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095
  * nvme: Add NVM Command Set specific identify namespace command
  * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
- Include precompiled documentation</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 2.0-rc4:
  * netapp-nvme: free the nsdescs pointer after use
  * netapp-nvme: fix ontapdevices segfault in json output
  * nvme-print: fix 'nvme list -o json' segfault
  * nvme: get_ns_id command fails on nvme device
  * wdc: updated products list for telemetry (--type) argument
  * docs: fix typo in Data Set Management section
  * Fix ctrlist for attach-ns and detach-ns
  * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices
  * wdc: Fix use-after-free access of cbs_data
  * Fixed regression with 'open namespace exclusive' (bsc#1195945)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 2.0-rc5:
  * nvme: passthru bugfix(wrong jump, wrong file descriptor)
  * nvme-cli: Ignore traddr case (bsc#1194025)
  * nvme: fix segfault in nvme telemetry-log error handling
  * fabrics: ensure zero kato for non-persistent controllers
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 2.0-rc6:
  * nvme: print out ANA state for 'list-subsys' (bsc#1195938)
  * nvme: Explicit initialize all command line options (bsc#1195945)
  * nvme: Explicit initialize passthru command line options
  * nvme: list_ns bug fix (csi option enable)
  * nvme: nvme write bug fix (no parse for option)
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 2.0-rc7:
  * netapp-nvme: fix smdevices segfault in json output (bsc#1195937)
  * fabrics: keep the backward compatibility
  * nvme: Do not slash escape strings in JSON output (bsc#1195937)
  * nvme: Print full device path
  * nvme-print: Make JSON keys consistent with nvme-cli 1.x
  * nvme-print: print generic device in list command
  * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061)
  * connect: Set errno to zero on nvmf_add_ctrl() success
  * documenation updates
- Set path to systemctl via newly introduced config option
- Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename
- Moved bash completion script to /usr/share/bash-completion/completions/nvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647950400">- Fix install conflict caused by new bash completion script
  location (bsc#1197365).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 2.0-rc8:
  * fabrics: Add DIM command
  * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076)
  * fabrics: Free non-matching controller during discovery
  * fabrics: add 'nvme config' command
  * fabrics: Correctly stringify discovery.conf and config.json paths
  * nvme-print: Add human readable print for nsattr field
  * nvme-print: Update Persistent Event log fields
  * nvme-print: print discovery async event support
  * nvme-rpmb: Fix spelling for 'Partition'
  * nvme-copy: add missing field to the command
  * nvme: add get_mi_cmd_support_effects_log command
  * nvme: Fixup namespace filtering yet again
  * nvme: Use type bool for OPT_FLAG
  * nvme: use filter for 'list-subsys &lt;devname&gt;' (bsc#1195938)
  * Add lbstm option to create-ns
  * argconfig: Do not use default value loading by getopt_long_only
  * argconfig: Rename CFG_NONE to CFG_FLAG
  * plugins: Use type bool for OPT_FLAG
  * documenation updates
- Drop 'ProtectKernelTunables=true' (bsc#1197076)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 2.0:
  * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243)
  * fabrics: Set KATO for discovery controller when connecting
  * fabrics: Do no modify default config for discovery controller
  * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858)
  * fabrics: Support connect even when no /etc/nvme/hostnqn file exists
  * nvme: update to nvme_scan_filter_t modifications (bsc#1195938)
  * plugins/intel: make 'buckets' a json array
  * plugins: Update WDC capabilities command with new commmands
  * plugins: Add OCP plugin</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- fabrics: Already connected uses a different error code (bsc#1199994)
  * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
- fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994)
  * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
- nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990)
  * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
- fabrics: Honor config file for connect-all (bsc#1199504)
  * add 0005-fabrics-Honor-config-file-for-connect-all.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701)
  * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
- Fabrics related bug fixes
  * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 2.2.1 (jsc#ped-553):
  * Added parsing for Solidigm telemetry observable data.
  * Revert "udev: re-read the discovery log page when a discovery controller reconnected"
  * add item ddr_ecc_err_cnt in smart-log-add
  * build and install fixes/improvements
  * build: Add minimum build requirement on libnvme
  * build: Drop dependency on libuuid
  * build: Extend release script to support micro version releases
  * build: Fix endian check for cross build
  * build: Remove unused uuid.wrap file
  * build: Remove unusned uuid.h include
  * build: Update release version rules
  * build: Update version before regenerating docs
  * completions: Add show-topology tab completion
  * documentation fixes
  * fabrics: Avoid nvme_scan_ctrl when disconnecting
  * fabrics: Honor JSON config file in connect-all command
  * fabrics: Remove dhchap-ctrl-secret from discover/connect-all
  * fabrics: Trigger auto connect if config.json exists
  * fabrics: fix 'persistent' handling during connect-all with JSON file
  * fabrics: nvme config --modify depends on -n and -t argument
  * fabrics: re-read the discovery log page when a discovery controller reconnected
  * json: Support uint64 types serialization for older json-c versions
  * meson: we don't need a c++ compiler
  * new solidigm plugin
  * nvme, plugins: fix __u64 -&gt; unsigned long long assumptions
  * nvme-print: Add missing values in id-ctrl for JSON output
  * nvme-print: Handle NULL hostid in JSON output
  * nvme-print: Output 128bit values as uint128 type instead of double
  * nvme-print: Print fguid as a UUID
  * nvme-print: Use uint128 JSON function for media_units_written
  * nvme-print: decode MI status values
  * nvme-print: decode status types
  * nvme-print: fix wrong json key
  * nvme-print: sanitize the get-feature async event config output
  * nvme: Add helper function to parse 16-bit comma separated list
  * nvme: Add nvme_cmd wrapper for get_features
  * nvme: Add show-topology command
  * nvme: Add wrapper for Format NVM
  * nvme: Add wrapper for Sanitize NVM
  * nvme: Add wrappers for Get Log page helpers
  * nvme: Add wrappers for Identify controller lists
  * nvme: Add wrappers for NS attach/detach
  * nvme: Add wrappers for NS management functions
  * nvme: Add wrappers for basic NS identify
  * nvme: Add wrappers for firmware commands
  * nvme: Do not print error message in collect_effects_log helper
  * nvme: Fix set feature command to get feature identifier 0Dh length as zero
  * nvme: Introduce a union in struct nvme_dev for different transport types
  * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl
  * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere
  * nvme: Masks SSTAT in sanize-log output
  * nvme: Remove static nvme_dev, allocate on open instead
  * nvme: Set default rae value for nvme_get_nsid_log users
  * nvme: Simplify ns list identify
  * nvme: Use correct print format specifier for sizeof arguments
  * nvme: Use local struct nvme_dev for show_registers &amp; map_registers
  * nvme: check if cfg.metadata is NULL before passing it to strlen()
  * nvme: use helpers for checking status types
  * plugins/innogrit: Include timer.h
  * plugins/innogrit: add smart items for smart-log-add
  * plugins/micron-nvme: Use correct print format specifier for sizeof arguments
  * plugins/ocp: Include timer.h
  * plugins/ocp: Output 128bit values as uint128 type instead of double
  * plugins/ocp: drop unused fd argument
  * plugins/ocp: pass struct nvme_dev to internal functions
  * plugins/seagate: Add support for OCP
  * plugins/solidigm: fix return value on format parse failure
  * plugins/toshiba: pass struct nvme_dev rather than fd + name
  * plugins/virtium: Output 128bit values as uint128 type instead of double
  * plugins/wdc: Add support for SN660 drive
  * plugins/wdc: Add type case for feature id
  * plugins/wdc: Output 128bit values as uint128 type instead of double
  * plugins/wdc: fix memset() on the address of a pointer
  * plugins/wdc: pass a struct nvme_dev around rather than a fd
  * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev
  * plugins/wdc: prevent duplicate close on NVMe device
  * plugins/wdc: remove fd argument from print functions
  * plugins/ytmc: pass struct nvme_dev rather than fd + name
  * plugins: Use PRIu64 format specifier for 64bit types
  * print: Add Controller Ready Timeout Exceeded HW error code
  * print: Fix nvme_id_uuid_list
  * solidgm: fix initialization warning
  * solidigm: Added parsing for telemetry customer screenable data
  * solidigm: Fix printf format for size_t variable
  * solidigm: Updated Telemetry parsing code to MIT license.
  * subprojects/libnvme: update for MI admin command coverage
  * tests: Update license to GPL-2.0-or-later
  * tree: Add NVMe-MI support
  * tree: Add dev_fd() helper
  * tree: Change nvme_dev from global to static
  * tree: Combine NVMe file descriptor into struct nvme_dev
  * tree: Move global device info to a single struct
  * tree: fail on non-negative return values from parse_and_open
  * udev: Add HOST_IFACE to udev rule
  * util/json.h: Add json_object_get_uint64 fallback implementation
  * util/json: Add 128 bit JSON helpers
  * util/types: Add 128 bit conversion helpers
  * util: Fix le128_to_cpu on big-endian
  * util: Fix le128_to_cpu on little-endian
  * util: Move common type conversion helpers into util section
  * utils/json: Add json_object_new_uint64 for json-c &lt; 0.14
  * utils: Fix uint128_t usage
  * various fixes reported by coverity
  * version reporting includes library version
  * wdc:  OCP Log page updates and fixes
  * wrapper: Add weak nvme_init_copy_range_f1 symbol
  * wrapper: Call library version of nvme_init_copy_range_f1
  * wrapper: Update SPDIX license
  * zns.c: report zones should be started after retrieved zone
- Drop upsreamp patches
  * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
  * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
  * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
  * remove 0005-fabrics-Honor-config-file-for-connect-all.patch
  * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
  * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch
- Handle suse-missing-rclink lint warnings by providing the symlinks
- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- Mark no binaries rpms as noarch</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 2.2.1+3.gd028407:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Add %check section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- spec file: fix "check" section (bsc#1207686)
- add "Provides: nvmeof-boot-support = 0.1"</changelog>
  <changelog author="daniel.wagner@suse.com" date="1684929600">- Update to version v2.4 (jsc#PED-553 jsc#PED-3884)
  - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435)
  * json_discovery_log: avoid buffer overrun
  - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001)
  * udev: Add HOST_IFACE to udev rule
  - Build documentation to be up to date
  - Fix build warning (git-fixes)
  * fabrics: 'e-&gt;traddr' is static
  - Improvements for supported-log-pages (bsc#1209550)
  * nvme-doc: update man page for supported-log-pages
  * nvme-print: sanitize supported-log-pages output
  - Fix read command (bsc#1209564)
  * nvme: fix block count and data size logic
  - Fix mounting filesystems via fstab (bsc#1208075)
  * fabrics: Fix ordering for auto connect services
  - Update host_traddr when using config.json file (bsc#1210089)
  * fabrics: fix fc config JSON file handling
  - remove 0100-harden_nvmf-connect@.service.patch
- Added compat commands for nbft back
- Changed default behavior of connect-all to match with old nbft
  behavior
- Replaced old nbft implementation with upstream one
- Rebuild documentation on package update
- Set version-tag so that version are correctly reported
- Fix connect nbft regressions (bsc#1209905)
  * fabrics: fix argc in show_nbft_compat_cmd()
- Fix auto connect conditions (bsc#1210105)
  * fabrics: fix conditions in nvmf-autoconnect.service
- Fix auto boot for NBFT connections (bsc#1211647)
  * fabrics: add udev rule to avoid renaming nbft interfaces
  * fabrics: autoconnect: add service unit for connecting NBFT subsystems</changelog>
  <changelog author="dwagner@suse.de" date="1690459200">- Update to version 2.4+24.ga1ee20:
  * nvme-print-stdout: Do not show non reachable ns in namespace topology (bsc#1212598)
  * nvme-print-stdout: List only ctrls which are part of ns bsc#1212598)
  * nvme-print-stdout: Support subsys reachable from several hosts bsc#1212598)
  * ccan: Add htable, strset and dependencies bsc#1212598)
  * ccan: Remove unused documentation bsc#1212598)
  * nvme-print: fix counter while looping through uuid_list (bsc#bsc#1212598)
  * nvme-print: Show subsystem iopolicy (bsc#1124564)</changelog>
  <changelog author="dwagner@suse.de" date="1693915200">- Update to version 2.4+25.g367eb9:
  * json: fix seg. fault converting NULL to JSON string (bsc#1213762)</changelog>
</package>
<package pkgid="2a6bcdbf7e415805dd2c35e683b9873b73bdc4f48b155b2374b7005798b19269" name="nvme-cli" arch="x86_64">
  <version epoch="0" ver="2.4+25.g367eb9" rel="150500.4.9.1"/>
  <changelog author="daniel.wagner@suse.com" date="1642507200">- Use osc_scm to manage upstream input source.
- Fix version string.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1642593600">- Fix zsh completion package depenedencies.</changelog>
  <changelog author="daniel.wagner@suse.com" date="1643716800">- Update to version 2.0~2:
  * Adapt to logging API changes in libnvme
  * Adapt to scan API changes in libnvme
  * Reworked error message handling
  * Fix 'list-ns' (bsc#1195151)
  * Add 'gen-tls-key' and 'check-tls-key'
  * Add Media Unit Status log page support
  * Cleanups and build fixes
- Fix path to systemctl (bsc#1193699)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1644580800">- Update to version v2.0-rc3:
  * nvme-print: Fix json output for list-subsys
  * nvme: Allow --verbose flag to increase log level
  * Added telemetry log fetch support for SN810, SN530 and SN740 series NVMe SSDs through wdc vs-internal-log command
  * nvmf: Remove --matching from systemd service file (bsc#1195665)
  * nvme: Fix --force flag inversion (bsc#1195637)
  * nvme: Add support for data area 4 to get-telemetry-log
  * nvme: Add Supported Capacity Configuration List log page(LID: 0x11)
  * nvme: Add Enhanced Controller Meta Data(FID: 0x7D)
  * nvme-print: Add NVME_FEAT_FID_ENH_CTRL_METADATA to nvme_feature_to_string
  * nvme-print: remove unused nvme_show_id_ctrl function
  * nvme: Add nvm-id-ns-lba-format(CNS 0Ah) command from TP4095
  * nvme: Add NVM Command Set specific identify namespace command
  * nvme: Add id-ns-lba-format(CNS 09h) command from TP4095
  * nvme: Add nulbaf(Number of Unique Capability LBA Formats) field on nvmd_id_ns
- Include precompiled documentation</changelog>
  <changelog author="daniel.wagner@suse.com" date="1645531200">- Update to version 2.0-rc4:
  * netapp-nvme: free the nsdescs pointer after use
  * netapp-nvme: fix ontapdevices segfault in json output
  * nvme-print: fix 'nvme list -o json' segfault
  * nvme: get_ns_id command fails on nvme device
  * wdc: updated products list for telemetry (--type) argument
  * docs: fix typo in Data Set Management section
  * Fix ctrlist for attach-ns and detach-ns
  * netapp-nvme: fix nvme ns desc uuid handling for ontapdevices
  * wdc: Fix use-after-free access of cbs_data
  * Fixed regression with 'open namespace exclusive' (bsc#1195945)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1646308800">- Update to version 2.0-rc5:
  * nvme: passthru bugfix(wrong jump, wrong file descriptor)
  * nvme-cli: Ignore traddr case (bsc#1194025)
  * nvme: fix segfault in nvme telemetry-log error handling
  * fabrics: ensure zero kato for non-persistent controllers
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647000000">- Update to version 2.0-rc6:
  * nvme: print out ANA state for 'list-subsys' (bsc#1195938)
  * nvme: Explicit initialize all command line options (bsc#1195945)
  * nvme: Explicit initialize passthru command line options
  * nvme: list_ns bug fix (csi option enable)
  * nvme: nvme write bug fix (no parse for option)
  * documenation updates</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647604800">- Update to version 2.0-rc7:
  * netapp-nvme: fix smdevices segfault in json output (bsc#1195937)
  * fabrics: keep the backward compatibility
  * nvme: Do not slash escape strings in JSON output (bsc#1195937)
  * nvme: Print full device path
  * nvme-print: Make JSON keys consistent with nvme-cli 1.x
  * nvme-print: print generic device in list command
  * fabrics: check for discovery controller instead of subsystem NQN (bsc#1197061)
  * connect: Set errno to zero on nvmf_add_ctrl() success
  * documenation updates
- Set path to systemctl via newly introduced config option
- Update 0100-harden_nvmf-connect@.service.patch due to upstream file rename
- Moved bash completion script to /usr/share/bash-completion/completions/nvme</changelog>
  <changelog author="daniel.wagner@suse.com" date="1647950400">- Fix install conflict caused by new bash completion script
  location (bsc#1197365).</changelog>
  <changelog author="daniel.wagner@suse.com" date="1648814400">- Update to version 2.0-rc8:
  * fabrics: Add DIM command
  * fabrics: Introduce force flag to overwrite persistence logic (bsc#1197076)
  * fabrics: Free non-matching controller during discovery
  * fabrics: add 'nvme config' command
  * fabrics: Correctly stringify discovery.conf and config.json paths
  * nvme-print: Add human readable print for nsattr field
  * nvme-print: Update Persistent Event log fields
  * nvme-print: print discovery async event support
  * nvme-rpmb: Fix spelling for 'Partition'
  * nvme-copy: add missing field to the command
  * nvme: add get_mi_cmd_support_effects_log command
  * nvme: Fixup namespace filtering yet again
  * nvme: Use type bool for OPT_FLAG
  * nvme: use filter for 'list-subsys &lt;devname&gt;' (bsc#1195938)
  * Add lbstm option to create-ns
  * argconfig: Do not use default value loading by getopt_long_only
  * argconfig: Rename CFG_NONE to CFG_FLAG
  * plugins: Use type bool for OPT_FLAG
  * documenation updates
- Drop 'ProtectKernelTunables=true' (bsc#1197076)</changelog>
  <changelog author="daniel.wagner@suse.com" date="1649419200">- Update to version 2.0:
  * fabrics: Create persistent controller using unique subsystem NQN (bsc#1198243)
  * fabrics: Set KATO for discovery controller when connecting
  * fabrics: Do no modify default config for discovery controller
  * fabrics: Set default trsvcid ports for TCP and RDMA (bsc#1195858)
  * fabrics: Support connect even when no /etc/nvme/hostnqn file exists
  * nvme: update to nvme_scan_filter_t modifications (bsc#1195938)
  * plugins/intel: make 'buckets' a json array
  * plugins: Update WDC capabilities command with new commmands
  * plugins: Add OCP plugin</changelog>
  <changelog author="dwagner@suse.de" date="1654603200">- fabrics: Already connected uses a different error code (bsc#1199994)
  * add 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
- fabrics: skip connect if the transport types don't match (bsc#1199949 bsc#1199994)
  * add 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
- nvme-print: Show ANA state only for one namespace (bsc#1200044 bsc#1199956 bsc#1199990)
  * add 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * add 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
- fabrics: Honor config file for connect-all (bsc#1199504)
  * add 0005-fabrics-Honor-config-file-for-connect-all.patch</changelog>
  <changelog author="dwagner@suse.de" date="1663761600">- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- fabrics: Remove dhchap-ctrl-secret from discover/connect-all (bsc#1201701)
  * add 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
- Fabrics related bug fixes
  * add 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * add 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * add 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * add 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * add 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * add 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * add 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * add 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * add 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch</changelog>
  <changelog author="daniel.wagner@suse.com" date="1667390400">- Update to version 2.2.1 (jsc#ped-553):
  * Added parsing for Solidigm telemetry observable data.
  * Revert "udev: re-read the discovery log page when a discovery controller reconnected"
  * add item ddr_ecc_err_cnt in smart-log-add
  * build and install fixes/improvements
  * build: Add minimum build requirement on libnvme
  * build: Drop dependency on libuuid
  * build: Extend release script to support micro version releases
  * build: Fix endian check for cross build
  * build: Remove unused uuid.wrap file
  * build: Remove unusned uuid.h include
  * build: Update release version rules
  * build: Update version before regenerating docs
  * completions: Add show-topology tab completion
  * documentation fixes
  * fabrics: Avoid nvme_scan_ctrl when disconnecting
  * fabrics: Honor JSON config file in connect-all command
  * fabrics: Remove dhchap-ctrl-secret from discover/connect-all
  * fabrics: Trigger auto connect if config.json exists
  * fabrics: fix 'persistent' handling during connect-all with JSON file
  * fabrics: nvme config --modify depends on -n and -t argument
  * fabrics: re-read the discovery log page when a discovery controller reconnected
  * json: Support uint64 types serialization for older json-c versions
  * meson: we don't need a c++ compiler
  * new solidigm plugin
  * nvme, plugins: fix __u64 -&gt; unsigned long long assumptions
  * nvme-print: Add missing values in id-ctrl for JSON output
  * nvme-print: Handle NULL hostid in JSON output
  * nvme-print: Output 128bit values as uint128 type instead of double
  * nvme-print: Print fguid as a UUID
  * nvme-print: Use uint128 JSON function for media_units_written
  * nvme-print: decode MI status values
  * nvme-print: decode status types
  * nvme-print: fix wrong json key
  * nvme-print: sanitize the get-feature async event config output
  * nvme: Add helper function to parse 16-bit comma separated list
  * nvme: Add nvme_cmd wrapper for get_features
  * nvme: Add show-topology command
  * nvme: Add wrapper for Format NVM
  * nvme: Add wrapper for Sanitize NVM
  * nvme: Add wrappers for Get Log page helpers
  * nvme: Add wrappers for Identify controller lists
  * nvme: Add wrappers for NS attach/detach
  * nvme: Add wrappers for NS management functions
  * nvme: Add wrappers for basic NS identify
  * nvme: Add wrappers for firmware commands
  * nvme: Do not print error message in collect_effects_log helper
  * nvme: Fix set feature command to get feature identifier 0Dh length as zero
  * nvme: Introduce a union in struct nvme_dev for different transport types
  * nvme: Introduce nvme_cli_ wrappers, wrap identify and identify_ctrl
  * nvme: Make static nvme_dev private to open_dev(), use locals elsewhere
  * nvme: Masks SSTAT in sanize-log output
  * nvme: Remove static nvme_dev, allocate on open instead
  * nvme: Set default rae value for nvme_get_nsid_log users
  * nvme: Simplify ns list identify
  * nvme: Use correct print format specifier for sizeof arguments
  * nvme: Use local struct nvme_dev for show_registers &amp; map_registers
  * nvme: check if cfg.metadata is NULL before passing it to strlen()
  * nvme: use helpers for checking status types
  * plugins/innogrit: Include timer.h
  * plugins/innogrit: add smart items for smart-log-add
  * plugins/micron-nvme: Use correct print format specifier for sizeof arguments
  * plugins/ocp: Include timer.h
  * plugins/ocp: Output 128bit values as uint128 type instead of double
  * plugins/ocp: drop unused fd argument
  * plugins/ocp: pass struct nvme_dev to internal functions
  * plugins/seagate: Add support for OCP
  * plugins/solidigm: fix return value on format parse failure
  * plugins/toshiba: pass struct nvme_dev rather than fd + name
  * plugins/virtium: Output 128bit values as uint128 type instead of double
  * plugins/wdc: Add support for SN660 drive
  * plugins/wdc: Add type case for feature id
  * plugins/wdc: Output 128bit values as uint128 type instead of double
  * plugins/wdc: fix memset() on the address of a pointer
  * plugins/wdc: pass a struct nvme_dev around rather than a fd
  * plugins/wdc: pass struct nvme_dev rather than using global nvme_dev
  * plugins/wdc: prevent duplicate close on NVMe device
  * plugins/wdc: remove fd argument from print functions
  * plugins/ytmc: pass struct nvme_dev rather than fd + name
  * plugins: Use PRIu64 format specifier for 64bit types
  * print: Add Controller Ready Timeout Exceeded HW error code
  * print: Fix nvme_id_uuid_list
  * solidgm: fix initialization warning
  * solidigm: Added parsing for telemetry customer screenable data
  * solidigm: Fix printf format for size_t variable
  * solidigm: Updated Telemetry parsing code to MIT license.
  * subprojects/libnvme: update for MI admin command coverage
  * tests: Update license to GPL-2.0-or-later
  * tree: Add NVMe-MI support
  * tree: Add dev_fd() helper
  * tree: Change nvme_dev from global to static
  * tree: Combine NVMe file descriptor into struct nvme_dev
  * tree: Move global device info to a single struct
  * tree: fail on non-negative return values from parse_and_open
  * udev: Add HOST_IFACE to udev rule
  * util/json.h: Add json_object_get_uint64 fallback implementation
  * util/json: Add 128 bit JSON helpers
  * util/types: Add 128 bit conversion helpers
  * util: Fix le128_to_cpu on big-endian
  * util: Fix le128_to_cpu on little-endian
  * util: Move common type conversion helpers into util section
  * utils/json: Add json_object_new_uint64 for json-c &lt; 0.14
  * utils: Fix uint128_t usage
  * various fixes reported by coverity
  * version reporting includes library version
  * wdc:  OCP Log page updates and fixes
  * wrapper: Add weak nvme_init_copy_range_f1 symbol
  * wrapper: Call library version of nvme_init_copy_range_f1
  * wrapper: Update SPDIX license
  * zns.c: report zones should be started after retrieved zone
- Drop upsreamp patches
  * remove 0001-fabrics-Already-connected-uses-a-different-error-cod.patch
  * remove 0002-fabrics-skip-connect-if-the-transport-types-don-t-ma.patch
  * remove 0003-nvme-print-Show-paths-from-the-first-namespace-only.patch
  * remove 0004-nvme-print-Show-ANA-state-only-for-one-namespace.patch
  * remove 0005-fabrics-Honor-config-file-for-connect-all.patch
  * remove 0006-fabrics-Remove-dhchap-ctrl-secret-from-discover-conn.patch
  * remove 0007-fabrics-error-message-for-nvme-discover-connect-all-.patch
  * remove 0008-fabrics-avoid-segfault-when-nvme-discover-fails-with.patch
  * remove 0009-fabrics-avoid-segfault-if-transport-type-is-omitted.patch
  * remove 0010-nvme-Return-status-error-code-for-effects-log-comman.patch
  * remove 0011-nvme-fix-nvme-get-feature-with-H-option.patch
  * remove 0012-fabrics-Avoid-nvme_scan_ctrl-when-disconnecting.patch
  * remove 0013-nvme-Do-not-print-error-message-in-collect_effects_l.patch
  * remove 0014-nvme-print-Handle-NULL-hostid-in-JSON-output.patch
  * remove 0015-nvme-print-sanitize-the-get-feature-async-event-conf.patch
- Handle suse-missing-rclink lint warnings by providing the symlinks
- Support auto discovery, add %systemd_ordering to spec file (bsc#1186399)
- Mark no binaries rpms as noarch</changelog>
  <changelog author="mwilck@suse.com" date="1674216000">- Update to version 2.2.1+3.gd028407:
  * Add support for booting from NVMe-oF/TCP according to NVM Express
  Boot Specification v1.0 (jsc#PED-1449)
  * Add support for "nvme show-nbft" and "nvme connect-nbft" subcommands</changelog>
  <changelog author="mwilck@suse.com" date="1674561600">- Add %check section in spec file to run unit tests</changelog>
  <changelog author="mwilck@suse.com" date="1675080000">- spec file: fix "check" section (bsc#1207686)
- add "Provides: nvmeof-boot-support = 0.1"</changelog>
  <changelog author="daniel.wagner@suse.com" date="1684929600">- Update to version v2.4 (jsc#PED-553 jsc#PED-3884)
  - Sanitize traddr and trsvcid avoid buffer overrun (bsc#1207435)
  * json_discovery_log: avoid buffer overrun
  - Extend udev rule to pass --host-interface argument to nvme-cli (bsc#1208001)
  * udev: Add HOST_IFACE to udev rule
  - Build documentation to be up to date
  - Fix build warning (git-fixes)
  * fabrics: 'e-&gt;traddr' is static
  - Improvements for supported-log-pages (bsc#1209550)
  * nvme-doc: update man page for supported-log-pages
  * nvme-print: sanitize supported-log-pages output
  - Fix read command (bsc#1209564)
  * nvme: fix block count and data size logic
  - Fix mounting filesystems via fstab (bsc#1208075)
  * fabrics: Fix ordering for auto connect services
  - Update host_traddr when using config.json file (bsc#1210089)
  * fabrics: fix fc config JSON file handling
  - remove 0100-harden_nvmf-connect@.service.patch
- Added compat commands for nbft back
- Changed default behavior of connect-all to match with old nbft
  behavior
- Replaced old nbft implementation with upstream one
- Rebuild documentation on package update
- Set version-tag so that version are correctly reported
- Fix connect nbft regressions (bsc#1209905)
  * fabrics: fix argc in show_nbft_compat_cmd()
- Fix auto connect conditions (bsc#1210105)
  * fabrics: fix conditions in nvmf-autoconnect.service
- Fix auto boot for NBFT connections (bsc#1211647)
  * fabrics: add udev rule to avoid renaming nbft interfaces
  * fabrics: autoconnect: add service unit for connecting NBFT subsystems</changelog>
  <changelog author="dwagner@suse.de" date="1690459200">- Update to version 2.4+24.ga1ee20:
  * nvme-print-stdout: Do not show non reachable ns in namespace topology (bsc#1212598)
  * nvme-print-stdout: List only ctrls which are part of ns bsc#1212598)
  * nvme-print-stdout: Support subsys reachable from several hosts bsc#1212598)
  * ccan: Add htable, strset and dependencies bsc#1212598)
  * ccan: Remove unused documentation bsc#1212598)
  * nvme-print: fix counter while looping through uuid_list (bsc#bsc#1212598)
  * nvme-print: Show subsystem iopolicy (bsc#1124564)</changelog>
  <changelog author="dwagner@suse.de" date="1693915200">- Update to version 2.4+25.g367eb9:
  * json: fix seg. fault converting NULL to JSON string (bsc#1213762)</changelog>
</package>
<package pkgid="6dd1eb15087fd6f4fec849d60becd881be2e9640218aed1ac4cba2eb8045064a" name="open-vm-tools" arch="src">
  <version epoch="0" ver="12.3.0" rel="150300.40.1"/>
  <changelog author="dimstar@opensuse.org" date="1616760000">- Add open-vm-tools-glib-2.67.patch: Fix build with glib 2.67.
  Patch has been borrowed by Fedora, upstream is still busy working
  out a patch (I'd not be surprised if they end up merging this
  finally.
  https://github.com/vmware/open-vm-tools/issues/500</changelog>
  <changelog author="kallan@suse.com" date="1620302400">- Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools
  package fails.</changelog>
  <changelog author="kallan@suse.com" date="1624536000">- Update to 11.3.0 (build 18090558) (boo#1187567)
  + Resolved issues:
  - The following github issues and pull requests have been resolved:
    446, 481, 500, and 509
  - The following Pull requests have been resolved: 474 and 505
  - A number of issues detected by Coverity, internally or by third parties,
    have been addressed.
  - A command line tool, vmwgfxctrl, has been added to open-vm-tools for
    Linux that can be used to control various aspects of the vmwgfx Linux
    kernel module.  Currently it can both display and set the current
    topology of the vmwgfx kernel driver. It is useful when trying to
    configure custom resolutions on recent Linux distributions, including
    multi-monitor setups.
  - A command line tool, vmware-alias-import, has been added to
    open-vm-tools that can be used to import vgauth config data and apply
    it to the running vgauth service.
  - Enhancements to support or utilize various vSphere features.
- Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path
  "/var/run" to "/run" for it's PIDfile.
- Update pam-vmtoolsd.patch to compensate for new line numbers.
- Drop patch now contained in 11.3.0:
  - open-vm-tools-glib-2.67.patch
  - open-vm-tools-pollGtk.patch</changelog>
  <changelog author="kallan@suse.com" date="1633348800">- Update to 11.3.5 (build 18557794) (boo#1190987)
  + New/Updated features:
  - Added a configurable logging capability to the network script.
    The network script has been updated to:
    use vmware-toolbox-cmd to query any network logging configuration from
    the tools.conf file.  Use vmtoolsd --cmd "log ..." to log a message to
    the vmx logfile when the logging handler is configured to "vmx" or when
    the logfile is full or is not writeable.
  - The hgfsmounter (mount.vmhgfs) command has been removed from
    open-vm-tools.
    The hgfsmounter (mount.vmhgfs) command is no longer used in
    Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore,
    removing all references to the hgfsmounter in Linux builds.
  + Resolved issues:
  - Customization: Retry the Linux reboot if telinit is a soft link to
    systemctl.
  - Open-vm-tools commands would hang if configured with "--enable-valgrind".
  + Spec file updates for:
  - rpmlint errors
  - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling.</changelog>
  <changelog author="kallan@suse.com" date="1648468800">- Update to 12.0.0 (build 19345655) (boo#1196803)
- jsc#SLE-24097 ECO Update open-vm-tools 12.0.0
  + New/Updated features:
  - Support for managing Salt Minion through guest variables.  A new
    open-vm-tools-salt-minion rpm is added to handle this support.
    jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4
    jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3
    jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5
  - New ComponentMgr plugin to manage (add, remove, monitor) components on
    the guest VM.
  - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804).
  - Build vmhgfs with either libfuse2 or libfuse3.
  + A number of Coverity and Codacy reported issues have been addressed.
  + The following issues and pull requests reported on
    github.com/vmware/open-vm-tools have been addressed: Issue # 128,
    Issue # 314, Pull # 513, Pull # 544, Pull # 573
- Added patches
  + gcc_size_t.patch (boo#1196804)</changelog>
  <changelog author="kallan@suse.com" date="1661428800">- Update to 12.1.0 (build 20219665) (boo#1202733)
  + New/Updated features:
  - Contains security update fix for (bsc#1202657) - (CVE-2022-31676)
    VUL-0: CVE-2022-31676: open-vm-tools:
    local privilege escalation vulnerability
  + A number of Coverity reported issues have been addressed.
  + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux
    release:
    https://github.com/vmware/open-vm-tools/pull/588
  + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit)
    This change incorporates the support of 64 bit time epoch conversion
    from Windows NT time to Unix Epoch time on i386.
    https://github.com/vmware/open-vm-tools/pull/387
- Drop patch now contained in 12.1.0:
  + gcc_size_t.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1670500800">- Add _service to handle open-vm-tools sources
- Update to 12.1.5 (build 20735119) (boo#1205962)
  - A number of Coverity reported issues have been addressed.
  - The deployPkg plugin may prematurely reboot the guest VM before cloud-init
    has completed user data setup. If both the Perl based Linux customization
    script and cloud-init run when the guest VM boots, the deployPkg plugin
    may reboot the guest before cloud-init has finished. The deployPkg
    plugin has been updated to wait for a running cloud-init process to
    finish before the guest VM reboot is initiated. This issue is fixed in
    this release.
  - A SIGSEGV may be encountered when a non-quiesing snapshot times out.
    This issue is fixed in this release.
  - Unwanted vmtoolsd service error message if not on a VMware hypervisor.
    When open-vm-tools comes preinstalled in a base Linux release, the vmtoolsd
    services are started automatically at system start and desktop login.
    If running on physical hardware or in a non-VMware hypervisor, the services
    will emit an error message to the Systemd's logging service before stopping.
    This issue is fixed in this release.</changelog>
  <changelog author="caleb.crane@suse.com" date="1670846400">- Add containerInfo plugin (jsc-PED-1344)
  - Add dependencies on grpc, protobuf, and containerd for container
    introspection
- Added patches (jsc-PED-1344)
  + detect-suse-location.patch</changelog>
  <changelog author="kallan@suse.com" date="1670932800">- Don't use new LDFLAGS, -labsl_synchronization -lgpr, when building for SLE.</changelog>
  <changelog author="kallan@suse.com" date="1671019200">- Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires
  section.  The dependencies will be added automatically.</changelog>
  <changelog author="schubi@suse.com" date="1672228800">- Migration of PAM settings to /usr/lib/pam.d.</changelog>
  <changelog author="kallan@suse.com" date="1680004800">- Update to 12.2.0 (build 21223074) (boo#1209128)
  - There are no new features in the open-vm-tools 12.2.0 release. This is
    primarily a maintenance release that addresses a few critical problems,
    including:
  - Linux quiesced snapshots have been updated to avoid intermittent hangs of
    the vmtoolsd process.
  - Updated the guestOps to handle some edge cases when File_GetSize() fails
    or returns -1.
  - A number of Coverity reported issues have been addressed.
  - Detect the proto files for the containerd grpc client in alternate
    locations.  Pull request #626
  - FreeBSD: Support newer releases and code clean-up for earlier versions.
    Pull request #584
  - Please refer to the release notes at
    https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md
  - The granular changes that have gone into the 12.2.0 release are in the
    ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/
    open-vm-tools/ChangeLog
- Update detect-suse-location.patch to remove upstream accepted portion of the
  patch (jsc-PED-1344).</changelog>
  <changelog author="kallan@suse.com" date="1680609600">- As per jsc-PED-1344, update spec file to only build the containerinfo
  plugin for TW/SLES 15 SP5 and newer.</changelog>
  <changelog author="jengelh@inai.de" date="1683028800">- Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch,
  0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch
  [boo#1210695]
- Reduce generated script size by coalescing multiple %service_*</changelog>
  <changelog author="kallan@suse.com" date="1686571200">- Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867:
  open-vm-tools: Authentication Bypass vulnerability in the vgauth
  module
  + Add patch: 2023-20867-Remove-some-dead-code.patch</changelog>
  <changelog author="dmueller@suse.com" date="1687867200">- limit to protobuf &lt; 22 for now until build failures have been fixed</changelog>
  <changelog author="kallan@suse.com" date="1693224000">- Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900:
  open-vm-tools: SAML token signature bypass vulnerability
  + Add patch: CVE-20230-20900.patch</changelog>
  <changelog author="kallan@suse.com" date="1694001600">- Update to 12.3.0 (build 22234872) (boo#1214850)
  - There are no new features in the open-vm-tools 12.3.0 release. This is
    primarily a maintenance release that addresses a few critical problems,
    including:
  - This release integrates CVE-2023-20900 without the need for a patch.
    For more information on this vulnerability and its impact on VMware
    products, see
    https://www.vmware.com/security/advisories/VMSA-2023-0019.html.
  - A tools.conf configuration setting is available to temporaily direct
    Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior
    of ignoring file systems already frozen.
  - Building of the VMware Guest Authentication Service (VGAuth) using
    "xml-security-c" and "xerces-c" is being deprecated.
  - A number of Coverity reported issues have been addressed.
  - A number of GitHub issues and pull requests have been handled.
    Please see the Resolves Issues section of the Release Notes.
  - For issues resolved in this release, see the Resolved Issues section
    of the Release Notes.
  - For complete details, see:
    https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0
  - Release Notes are available at
    https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md
  - The granular changes that have gone into the 12.3.0 release are in the
    ChangeLog at
    https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog
- Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests
- jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4.
- Drop patch now contained in 12.3.0:
  + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch
  + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch
  + 2023-20867-Remove-some-dead-code.patch
  + CVE-20230-20900.patch</changelog>
  <changelog author="meissner@suse.com" date="1695297600">- open-vm-tools is built with containerinfo plugin from 15 sp3 onwards</changelog>
  <changelog author="kallan@suse.com" date="1695902400">- 15 sp4 currently uses open-vm-tools rpms from 15 sp3.  As such, enable
  the spec file fix for bug (bsc#1205927) for 15 sp3 onwards.</changelog>
</package>
<package pkgid="074b3782faa8af65d3f018bdc1da4882b0fb4ea3cd14ff1e1fc7dc5518cddbd7" name="open-vm-tools" arch="x86_64">
  <version epoch="0" ver="12.3.0" rel="150300.40.1"/>
  <changelog author="dimstar@opensuse.org" date="1616760000">- Add open-vm-tools-glib-2.67.patch: Fix build with glib 2.67.
  Patch has been borrowed by Fedora, upstream is still busy working
  out a patch (I'd not be surprised if they end up merging this
  finally.
  https://github.com/vmware/open-vm-tools/issues/500</changelog>
  <changelog author="kallan@suse.com" date="1620302400">- Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools
  package fails.</changelog>
  <changelog author="kallan@suse.com" date="1624536000">- Update to 11.3.0 (build 18090558) (boo#1187567)
  + Resolved issues:
  - The following github issues and pull requests have been resolved:
    446, 481, 500, and 509
  - The following Pull requests have been resolved: 474 and 505
  - A number of issues detected by Coverity, internally or by third parties,
    have been addressed.
  - A command line tool, vmwgfxctrl, has been added to open-vm-tools for
    Linux that can be used to control various aspects of the vmwgfx Linux
    kernel module.  Currently it can both display and set the current
    topology of the vmwgfx kernel driver. It is useful when trying to
    configure custom resolutions on recent Linux distributions, including
    multi-monitor setups.
  - A command line tool, vmware-alias-import, has been added to
    open-vm-tools that can be used to import vgauth config data and apply
    it to the running vgauth service.
  - Enhancements to support or utilize various vSphere features.
- Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path
  "/var/run" to "/run" for it's PIDfile.
- Update pam-vmtoolsd.patch to compensate for new line numbers.
- Drop patch now contained in 11.3.0:
  - open-vm-tools-glib-2.67.patch
  - open-vm-tools-pollGtk.patch</changelog>
  <changelog author="kallan@suse.com" date="1633348800">- Update to 11.3.5 (build 18557794) (boo#1190987)
  + New/Updated features:
  - Added a configurable logging capability to the network script.
    The network script has been updated to:
    use vmware-toolbox-cmd to query any network logging configuration from
    the tools.conf file.  Use vmtoolsd --cmd "log ..." to log a message to
    the vmx logfile when the logging handler is configured to "vmx" or when
    the logfile is full or is not writeable.
  - The hgfsmounter (mount.vmhgfs) command has been removed from
    open-vm-tools.
    The hgfsmounter (mount.vmhgfs) command is no longer used in
    Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore,
    removing all references to the hgfsmounter in Linux builds.
  + Resolved issues:
  - Customization: Retry the Linux reboot if telinit is a soft link to
    systemctl.
  - Open-vm-tools commands would hang if configured with "--enable-valgrind".
  + Spec file updates for:
  - rpmlint errors
  - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling.</changelog>
  <changelog author="kallan@suse.com" date="1648468800">- Update to 12.0.0 (build 19345655) (boo#1196803)
- jsc#SLE-24097 ECO Update open-vm-tools 12.0.0
  + New/Updated features:
  - Support for managing Salt Minion through guest variables.  A new
    open-vm-tools-salt-minion rpm is added to handle this support.
    jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4
    jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3
    jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5
  - New ComponentMgr plugin to manage (add, remove, monitor) components on
    the guest VM.
  - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804).
  - Build vmhgfs with either libfuse2 or libfuse3.
  + A number of Coverity and Codacy reported issues have been addressed.
  + The following issues and pull requests reported on
    github.com/vmware/open-vm-tools have been addressed: Issue # 128,
    Issue # 314, Pull # 513, Pull # 544, Pull # 573
- Added patches
  + gcc_size_t.patch (boo#1196804)</changelog>
  <changelog author="kallan@suse.com" date="1661428800">- Update to 12.1.0 (build 20219665) (boo#1202733)
  + New/Updated features:
  - Contains security update fix for (bsc#1202657) - (CVE-2022-31676)
    VUL-0: CVE-2022-31676: open-vm-tools:
    local privilege escalation vulnerability
  + A number of Coverity reported issues have been addressed.
  + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux
    release:
    https://github.com/vmware/open-vm-tools/pull/588
  + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit)
    This change incorporates the support of 64 bit time epoch conversion
    from Windows NT time to Unix Epoch time on i386.
    https://github.com/vmware/open-vm-tools/pull/387
- Drop patch now contained in 12.1.0:
  + gcc_size_t.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1670500800">- Add _service to handle open-vm-tools sources
- Update to 12.1.5 (build 20735119) (boo#1205962)
  - A number of Coverity reported issues have been addressed.
  - The deployPkg plugin may prematurely reboot the guest VM before cloud-init
    has completed user data setup. If both the Perl based Linux customization
    script and cloud-init run when the guest VM boots, the deployPkg plugin
    may reboot the guest before cloud-init has finished. The deployPkg
    plugin has been updated to wait for a running cloud-init process to
    finish before the guest VM reboot is initiated. This issue is fixed in
    this release.
  - A SIGSEGV may be encountered when a non-quiesing snapshot times out.
    This issue is fixed in this release.
  - Unwanted vmtoolsd service error message if not on a VMware hypervisor.
    When open-vm-tools comes preinstalled in a base Linux release, the vmtoolsd
    services are started automatically at system start and desktop login.
    If running on physical hardware or in a non-VMware hypervisor, the services
    will emit an error message to the Systemd's logging service before stopping.
    This issue is fixed in this release.</changelog>
  <changelog author="caleb.crane@suse.com" date="1670846400">- Add containerInfo plugin (jsc-PED-1344)
  - Add dependencies on grpc, protobuf, and containerd for container
    introspection
- Added patches (jsc-PED-1344)
  + detect-suse-location.patch</changelog>
  <changelog author="kallan@suse.com" date="1670932800">- Don't use new LDFLAGS, -labsl_synchronization -lgpr, when building for SLE.</changelog>
  <changelog author="kallan@suse.com" date="1671019200">- Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires
  section.  The dependencies will be added automatically.</changelog>
  <changelog author="schubi@suse.com" date="1672228800">- Migration of PAM settings to /usr/lib/pam.d.</changelog>
  <changelog author="kallan@suse.com" date="1680004800">- Update to 12.2.0 (build 21223074) (boo#1209128)
  - There are no new features in the open-vm-tools 12.2.0 release. This is
    primarily a maintenance release that addresses a few critical problems,
    including:
  - Linux quiesced snapshots have been updated to avoid intermittent hangs of
    the vmtoolsd process.
  - Updated the guestOps to handle some edge cases when File_GetSize() fails
    or returns -1.
  - A number of Coverity reported issues have been addressed.
  - Detect the proto files for the containerd grpc client in alternate
    locations.  Pull request #626
  - FreeBSD: Support newer releases and code clean-up for earlier versions.
    Pull request #584
  - Please refer to the release notes at
    https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md
  - The granular changes that have gone into the 12.2.0 release are in the
    ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/
    open-vm-tools/ChangeLog
- Update detect-suse-location.patch to remove upstream accepted portion of the
  patch (jsc-PED-1344).</changelog>
  <changelog author="kallan@suse.com" date="1680609600">- As per jsc-PED-1344, update spec file to only build the containerinfo
  plugin for TW/SLES 15 SP5 and newer.</changelog>
  <changelog author="jengelh@inai.de" date="1683028800">- Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch,
  0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch
  [boo#1210695]
- Reduce generated script size by coalescing multiple %service_*</changelog>
  <changelog author="kallan@suse.com" date="1686571200">- Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867:
  open-vm-tools: Authentication Bypass vulnerability in the vgauth
  module
  + Add patch: 2023-20867-Remove-some-dead-code.patch</changelog>
  <changelog author="dmueller@suse.com" date="1687867200">- limit to protobuf &lt; 22 for now until build failures have been fixed</changelog>
  <changelog author="kallan@suse.com" date="1693224000">- Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900:
  open-vm-tools: SAML token signature bypass vulnerability
  + Add patch: CVE-20230-20900.patch</changelog>
  <changelog author="kallan@suse.com" date="1694001600">- Update to 12.3.0 (build 22234872) (boo#1214850)
  - There are no new features in the open-vm-tools 12.3.0 release. This is
    primarily a maintenance release that addresses a few critical problems,
    including:
  - This release integrates CVE-2023-20900 without the need for a patch.
    For more information on this vulnerability and its impact on VMware
    products, see
    https://www.vmware.com/security/advisories/VMSA-2023-0019.html.
  - A tools.conf configuration setting is available to temporaily direct
    Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior
    of ignoring file systems already frozen.
  - Building of the VMware Guest Authentication Service (VGAuth) using
    "xml-security-c" and "xerces-c" is being deprecated.
  - A number of Coverity reported issues have been addressed.
  - A number of GitHub issues and pull requests have been handled.
    Please see the Resolves Issues section of the Release Notes.
  - For issues resolved in this release, see the Resolved Issues section
    of the Release Notes.
  - For complete details, see:
    https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0
  - Release Notes are available at
    https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md
  - The granular changes that have gone into the 12.3.0 release are in the
    ChangeLog at
    https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog
- Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests
- jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4.
- Drop patch now contained in 12.3.0:
  + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch
  + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch
  + 2023-20867-Remove-some-dead-code.patch
  + CVE-20230-20900.patch</changelog>
  <changelog author="meissner@suse.com" date="1695297600">- open-vm-tools is built with containerinfo plugin from 15 sp3 onwards</changelog>
  <changelog author="kallan@suse.com" date="1695902400">- 15 sp4 currently uses open-vm-tools rpms from 15 sp3.  As such, enable
  the spec file fix for bug (bsc#1205927) for 15 sp3 onwards.</changelog>
</package>
<package pkgid="89dbcb6e0279ce2bd921ae279c049f4c3002672adfeafd097321bff693a741b5" name="open-vm-tools" arch="src">
  <version epoch="0" ver="12.3.0" rel="150300.43.1"/>
  <changelog author="kallan@suse.com" date="1620302400">- Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools
  package fails.</changelog>
  <changelog author="kallan@suse.com" date="1624536000">- Update to 11.3.0 (build 18090558) (boo#1187567)
  + Resolved issues:
  - The following github issues and pull requests have been resolved:
    446, 481, 500, and 509
  - The following Pull requests have been resolved: 474 and 505
  - A number of issues detected by Coverity, internally or by third parties,
    have been addressed.
  - A command line tool, vmwgfxctrl, has been added to open-vm-tools for
    Linux that can be used to control various aspects of the vmwgfx Linux
    kernel module.  Currently it can both display and set the current
    topology of the vmwgfx kernel driver. It is useful when trying to
    configure custom resolutions on recent Linux distributions, including
    multi-monitor setups.
  - A command line tool, vmware-alias-import, has been added to
    open-vm-tools that can be used to import vgauth config data and apply
    it to the running vgauth service.
  - Enhancements to support or utilize various vSphere features.
- Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path
  "/var/run" to "/run" for it's PIDfile.
- Update pam-vmtoolsd.patch to compensate for new line numbers.
- Drop patch now contained in 11.3.0:
  - open-vm-tools-glib-2.67.patch
  - open-vm-tools-pollGtk.patch</changelog>
  <changelog author="kallan@suse.com" date="1633348800">- Update to 11.3.5 (build 18557794) (boo#1190987)
  + New/Updated features:
  - Added a configurable logging capability to the network script.
    The network script has been updated to:
    use vmware-toolbox-cmd to query any network logging configuration from
    the tools.conf file.  Use vmtoolsd --cmd "log ..." to log a message to
    the vmx logfile when the logging handler is configured to "vmx" or when
    the logfile is full or is not writeable.
  - The hgfsmounter (mount.vmhgfs) command has been removed from
    open-vm-tools.
    The hgfsmounter (mount.vmhgfs) command is no longer used in
    Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore,
    removing all references to the hgfsmounter in Linux builds.
  + Resolved issues:
  - Customization: Retry the Linux reboot if telinit is a soft link to
    systemctl.
  - Open-vm-tools commands would hang if configured with "--enable-valgrind".
  + Spec file updates for:
  - rpmlint errors
  - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling.</changelog>
  <changelog author="kallan@suse.com" date="1648468800">- Update to 12.0.0 (build 19345655) (boo#1196803)
- jsc#SLE-24097 ECO Update open-vm-tools 12.0.0
  + New/Updated features:
  - Support for managing Salt Minion through guest variables.  A new
    open-vm-tools-salt-minion rpm is added to handle this support.
    jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4
    jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3
    jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5
  - New ComponentMgr plugin to manage (add, remove, monitor) components on
    the guest VM.
  - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804).
  - Build vmhgfs with either libfuse2 or libfuse3.
  + A number of Coverity and Codacy reported issues have been addressed.
  + The following issues and pull requests reported on
    github.com/vmware/open-vm-tools have been addressed: Issue # 128,
    Issue # 314, Pull # 513, Pull # 544, Pull # 573
- Added patches
  + gcc_size_t.patch (boo#1196804)</changelog>
  <changelog author="kallan@suse.com" date="1661428800">- Update to 12.1.0 (build 20219665) (boo#1202733)
  + New/Updated features:
  - Contains security update fix for (bsc#1202657) - (CVE-2022-31676)
    VUL-0: CVE-2022-31676: open-vm-tools:
    local privilege escalation vulnerability
  + A number of Coverity reported issues have been addressed.
  + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux
    release:
    https://github.com/vmware/open-vm-tools/pull/588
  + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit)
    This change incorporates the support of 64 bit time epoch conversion
    from Windows NT time to Unix Epoch time on i386.
    https://github.com/vmware/open-vm-tools/pull/387
- Drop patch now contained in 12.1.0:
  + gcc_size_t.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1670500800">- Add _service to handle open-vm-tools sources
- Update to 12.1.5 (build 20735119) (boo#1205962)
  - A number of Coverity reported issues have been addressed.
  - The deployPkg plugin may prematurely reboot the guest VM before cloud-init
    has completed user data setup. If both the Perl based Linux customization
    script and cloud-init run when the guest VM boots, the deployPkg plugin
    may reboot the guest before cloud-init has finished. The deployPkg
    plugin has been updated to wait for a running cloud-init process to
    finish before the guest VM reboot is initiated. This issue is fixed in
    this release.
  - A SIGSEGV may be encountered when a non-quiesing snapshot times out.
    This issue is fixed in this release.
  - Unwanted vmtoolsd service error message if not on a VMware hypervisor.
    When open-vm-tools comes preinstalled in a base Linux release, the vmtoolsd
    services are started automatically at system start and desktop login.
    If running on physical hardware or in a non-VMware hypervisor, the services
    will emit an error message to the Systemd's logging service before stopping.
    This issue is fixed in this release.</changelog>
  <changelog author="caleb.crane@suse.com" date="1670846400">- Add containerInfo plugin (jsc-PED-1344)
  - Add dependencies on grpc, protobuf, and containerd for container
    introspection
- Added patches (jsc-PED-1344)
  + detect-suse-location.patch</changelog>
  <changelog author="kallan@suse.com" date="1670932800">- Don't use new LDFLAGS, -labsl_synchronization -lgpr, when building for SLE.</changelog>
  <changelog author="kallan@suse.com" date="1671019200">- Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires
  section.  The dependencies will be added automatically.</changelog>
  <changelog author="schubi@suse.com" date="1672228800">- Migration of PAM settings to /usr/lib/pam.d.</changelog>
  <changelog author="kallan@suse.com" date="1680004800">- Update to 12.2.0 (build 21223074) (boo#1209128)
  - There are no new features in the open-vm-tools 12.2.0 release. This is
    primarily a maintenance release that addresses a few critical problems,
    including:
  - Linux quiesced snapshots have been updated to avoid intermittent hangs of
    the vmtoolsd process.
  - Updated the guestOps to handle some edge cases when File_GetSize() fails
    or returns -1.
  - A number of Coverity reported issues have been addressed.
  - Detect the proto files for the containerd grpc client in alternate
    locations.  Pull request #626
  - FreeBSD: Support newer releases and code clean-up for earlier versions.
    Pull request #584
  - Please refer to the release notes at
    https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md
  - The granular changes that have gone into the 12.2.0 release are in the
    ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/
    open-vm-tools/ChangeLog
- Update detect-suse-location.patch to remove upstream accepted portion of the
  patch (jsc-PED-1344).</changelog>
  <changelog author="kallan@suse.com" date="1680609600">- As per jsc-PED-1344, update spec file to only build the containerinfo
  plugin for TW/SLES 15 SP5 and newer.</changelog>
  <changelog author="jengelh@inai.de" date="1683028800">- Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch,
  0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch
  [boo#1210695]
- Reduce generated script size by coalescing multiple %service_*</changelog>
  <changelog author="kallan@suse.com" date="1686571200">- Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867:
  open-vm-tools: Authentication Bypass vulnerability in the vgauth
  module
  + Add patch: 2023-20867-Remove-some-dead-code.patch</changelog>
  <changelog author="dmueller@suse.com" date="1687867200">- limit to protobuf &lt; 22 for now until build failures have been fixed</changelog>
  <changelog author="kallan@suse.com" date="1693224000">- Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900:
  open-vm-tools: SAML token signature bypass vulnerability
  + Add patch: CVE-20230-20900.patch</changelog>
  <changelog author="kallan@suse.com" date="1694001600">- Update to 12.3.0 (build 22234872) (boo#1214850)
  - There are no new features in the open-vm-tools 12.3.0 release. This is
    primarily a maintenance release that addresses a few critical problems,
    including:
  - This release integrates CVE-2023-20900 without the need for a patch.
    For more information on this vulnerability and its impact on VMware
    products, see
    https://www.vmware.com/security/advisories/VMSA-2023-0019.html.
  - A tools.conf configuration setting is available to temporaily direct
    Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior
    of ignoring file systems already frozen.
  - Building of the VMware Guest Authentication Service (VGAuth) using
    "xml-security-c" and "xerces-c" is being deprecated.
  - A number of Coverity reported issues have been addressed.
  - A number of GitHub issues and pull requests have been handled.
    Please see the Resolves Issues section of the Release Notes.
  - For issues resolved in this release, see the Resolved Issues section
    of the Release Notes.
  - For complete details, see:
    https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0
  - Release Notes are available at
    https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md
  - The granular changes that have gone into the 12.3.0 release are in the
    ChangeLog at
    https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog
- Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests
- jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4.
- Drop patch now contained in 12.3.0:
  + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch
  + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch
  + 2023-20867-Remove-some-dead-code.patch
  + CVE-20230-20900.patch</changelog>
  <changelog author="meissner@suse.com" date="1695297600">- open-vm-tools is built with containerinfo plugin from 15 sp3 onwards</changelog>
  <changelog author="kallan@suse.com" date="1695902400">- 15 sp4 currently uses open-vm-tools rpms from 15 sp3.  As such, enable
  the spec file fix for bug (bsc#1205927) for 15 sp3 onwards.</changelog>
  <changelog author="kallan@suse.com" date="1697803200">- Fix (bsc#1216432) - VUL-0: CVE-2023-34058: open-vm-tools: SAML token
  signature bypass vulnerability.
- Fix (bsc#1216433) - VUL-0: : CVE-2023-34059: open-vm-tools: file
  descriptor hijack vulnerability
  + Add patch:
  - CVE-2023-34058.patch
  - CVE-2023-34059.patch</changelog>
</package>
<package pkgid="a5d51aa3d61016e60ba79464c7af260a6853af21040e1bd0698b94a7b6001348" name="open-vm-tools" arch="x86_64">
  <version epoch="0" ver="12.3.0" rel="150300.43.1"/>
  <changelog author="kallan@suse.com" date="1620302400">- Add open-vm-tools-pollGtk.patch: Fixes boo#1185103 GCC 11: open-vm-tools
  package fails.</changelog>
  <changelog author="kallan@suse.com" date="1624536000">- Update to 11.3.0 (build 18090558) (boo#1187567)
  + Resolved issues:
  - The following github issues and pull requests have been resolved:
    446, 481, 500, and 509
  - The following Pull requests have been resolved: 474 and 505
  - A number of issues detected by Coverity, internally or by third parties,
    have been addressed.
  - A command line tool, vmwgfxctrl, has been added to open-vm-tools for
    Linux that can be used to control various aspects of the vmwgfx Linux
    kernel module.  Currently it can both display and set the current
    topology of the vmwgfx kernel driver. It is useful when trying to
    configure custom resolutions on recent Linux distributions, including
    multi-monitor setups.
  - A command line tool, vmware-alias-import, has been added to
    open-vm-tools that can be used to import vgauth config data and apply
    it to the running vgauth service.
  - Enhancements to support or utilize various vSphere features.
- Fixed bug (bsc#1185175) In vmtoolsd.service move deprecated path
  "/var/run" to "/run" for it's PIDfile.
- Update pam-vmtoolsd.patch to compensate for new line numbers.
- Drop patch now contained in 11.3.0:
  - open-vm-tools-glib-2.67.patch
  - open-vm-tools-pollGtk.patch</changelog>
  <changelog author="kallan@suse.com" date="1633348800">- Update to 11.3.5 (build 18557794) (boo#1190987)
  + New/Updated features:
  - Added a configurable logging capability to the network script.
    The network script has been updated to:
    use vmware-toolbox-cmd to query any network logging configuration from
    the tools.conf file.  Use vmtoolsd --cmd "log ..." to log a message to
    the vmx logfile when the logging handler is configured to "vmx" or when
    the logfile is full or is not writeable.
  - The hgfsmounter (mount.vmhgfs) command has been removed from
    open-vm-tools.
    The hgfsmounter (mount.vmhgfs) command is no longer used in
    Linux open-vm-tools. It has been replaced by hgfs-fuse. Therefore,
    removing all references to the hgfsmounter in Linux builds.
  + Resolved issues:
  - Customization: Retry the Linux reboot if telinit is a soft link to
    systemctl.
  - Open-vm-tools commands would hang if configured with "--enable-valgrind".
  + Spec file updates for:
  - rpmlint errors
  - arg_xmlsec1 --enable-xmlsec1 for better xmlsec1/libxml2 handling.</changelog>
  <changelog author="kallan@suse.com" date="1648468800">- Update to 12.0.0 (build 19345655) (boo#1196803)
- jsc#SLE-24097 ECO Update open-vm-tools 12.0.0
  + New/Updated features:
  - Support for managing Salt Minion through guest variables.  A new
    open-vm-tools-salt-minion rpm is added to handle this support.
    jsc#SLE-24094 Update open-vm-tools 12.0.0 SLES15SP4
    jsc#SLE-24095 Update open-vm-tools 12.0.0 SLES15SP3
    jsc#SLE-24096 Update open-vm-tools 12.0.0 SLES12SP5
  - New ComponentMgr plugin to manage (add, remove, monitor) components on
    the guest VM.
  - Patch to fix potential Fail to Build from Source [FTBFS] (boo#1196804).
  - Build vmhgfs with either libfuse2 or libfuse3.
  + A number of Coverity and Codacy reported issues have been addressed.
  + The following issues and pull requests reported on
    github.com/vmware/open-vm-tools have been addressed: Issue # 128,
    Issue # 314, Pull # 513, Pull # 544, Pull # 573
- Added patches
  + gcc_size_t.patch (boo#1196804)</changelog>
  <changelog author="kallan@suse.com" date="1661428800">- Update to 12.1.0 (build 20219665) (boo#1202733)
  + New/Updated features:
  - Contains security update fix for (bsc#1202657) - (CVE-2022-31676)
    VUL-0: CVE-2022-31676: open-vm-tools:
    local privilege escalation vulnerability
  + A number of Coverity reported issues have been addressed.
  + [FTBFS] Fix the build of the ContainerInfo plugin for a 32-bit Linux
    release:
    https://github.com/vmware/open-vm-tools/pull/588
  + Make HgfsConvertFromNtTimeNsec aware of 64-bit time_t on i386 (32-bit)
    This change incorporates the support of 64 bit time epoch conversion
    from Windows NT time to Unix Epoch time on i386.
    https://github.com/vmware/open-vm-tools/pull/387
- Drop patch now contained in 12.1.0:
  + gcc_size_t.patch</changelog>
  <changelog author="caleb.crane@suse.com" date="1670500800">- Add _service to handle open-vm-tools sources
- Update to 12.1.5 (build 20735119) (boo#1205962)
  - A number of Coverity reported issues have been addressed.
  - The deployPkg plugin may prematurely reboot the guest VM before cloud-init
    has completed user data setup. If both the Perl based Linux customization
    script and cloud-init run when the guest VM boots, the deployPkg plugin
    may reboot the guest before cloud-init has finished. The deployPkg
    plugin has been updated to wait for a running cloud-init process to
    finish before the guest VM reboot is initiated. This issue is fixed in
    this release.
  - A SIGSEGV may be encountered when a non-quiesing snapshot times out.
    This issue is fixed in this release.
  - Unwanted vmtoolsd service error message if not on a VMware hypervisor.
    When open-vm-tools comes preinstalled in a base Linux release, the vmtoolsd
    services are started automatically at system start and desktop login.
    If running on physical hardware or in a non-VMware hypervisor, the services
    will emit an error message to the Systemd's logging service before stopping.
    This issue is fixed in this release.</changelog>
  <changelog author="caleb.crane@suse.com" date="1670846400">- Add containerInfo plugin (jsc-PED-1344)
  - Add dependencies on grpc, protobuf, and containerd for container
    introspection
- Added patches (jsc-PED-1344)
  + detect-suse-location.patch</changelog>
  <changelog author="kallan@suse.com" date="1670932800">- Don't use new LDFLAGS, -labsl_synchronization -lgpr, when building for SLE.</changelog>
  <changelog author="kallan@suse.com" date="1671019200">- Don't list libgrpc++, libgrpc, and libprotobuf in the containerinfo Requires
  section.  The dependencies will be added automatically.</changelog>
  <changelog author="schubi@suse.com" date="1672228800">- Migration of PAM settings to /usr/lib/pam.d.</changelog>
  <changelog author="kallan@suse.com" date="1680004800">- Update to 12.2.0 (build 21223074) (boo#1209128)
  - There are no new features in the open-vm-tools 12.2.0 release. This is
    primarily a maintenance release that addresses a few critical problems,
    including:
  - Linux quiesced snapshots have been updated to avoid intermittent hangs of
    the vmtoolsd process.
  - Updated the guestOps to handle some edge cases when File_GetSize() fails
    or returns -1.
  - A number of Coverity reported issues have been addressed.
  - Detect the proto files for the containerd grpc client in alternate
    locations.  Pull request #626
  - FreeBSD: Support newer releases and code clean-up for earlier versions.
    Pull request #584
  - Please refer to the release notes at
    https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/ReleaseNotes.md
  - The granular changes that have gone into the 12.2.0 release are in the
    ChangeLog at https://github.com/vmware/open-vm-tools/blob/stable-12.2.0/
    open-vm-tools/ChangeLog
- Update detect-suse-location.patch to remove upstream accepted portion of the
  patch (jsc-PED-1344).</changelog>
  <changelog author="kallan@suse.com" date="1680609600">- As per jsc-PED-1344, update spec file to only build the containerinfo
  plugin for TW/SLES 15 SP5 and newer.</changelog>
  <changelog author="jengelh@inai.de" date="1683028800">- Add 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch,
  0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch
  [boo#1210695]
- Reduce generated script size by coalescing multiple %service_*</changelog>
  <changelog author="kallan@suse.com" date="1686571200">- Fix (bsc#1212143) - (CVE-2023-20867) - VUL-0: CVE-2023-20867:
  open-vm-tools: Authentication Bypass vulnerability in the vgauth
  module
  + Add patch: 2023-20867-Remove-some-dead-code.patch</changelog>
  <changelog author="dmueller@suse.com" date="1687867200">- limit to protobuf &lt; 22 for now until build failures have been fixed</changelog>
  <changelog author="kallan@suse.com" date="1693224000">- Fix (bsc#1214566) - (CVE-2023-20900) - VUL-0: CVE-2023-20900:
  open-vm-tools: SAML token signature bypass vulnerability
  + Add patch: CVE-20230-20900.patch</changelog>
  <changelog author="kallan@suse.com" date="1694001600">- Update to 12.3.0 (build 22234872) (boo#1214850)
  - There are no new features in the open-vm-tools 12.3.0 release. This is
    primarily a maintenance release that addresses a few critical problems,
    including:
  - This release integrates CVE-2023-20900 without the need for a patch.
    For more information on this vulnerability and its impact on VMware
    products, see
    https://www.vmware.com/security/advisories/VMSA-2023-0019.html.
  - A tools.conf configuration setting is available to temporaily direct
    Linux quiesced snaphots to restore pre open-vm-tools 12.2.0 behavior
    of ignoring file systems already frozen.
  - Building of the VMware Guest Authentication Service (VGAuth) using
    "xml-security-c" and "xerces-c" is being deprecated.
  - A number of Coverity reported issues have been addressed.
  - A number of GitHub issues and pull requests have been handled.
    Please see the Resolves Issues section of the Release Notes.
  - For issues resolved in this release, see the Resolved Issues section
    of the Release Notes.
  - For complete details, see:
    https://github.com/vmware/open-vm-tools/releases/tag/stable-12.3.0
  - Release Notes are available at
    https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md
  - The granular changes that have gone into the 12.3.0 release are in the
    ChangeLog at
    https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/open-vm-tools/ChangeLog
- Fix (bsc#1205927) - hv_vmbus module is loaded unnecessarily in VMware guests
- jsc-PED-1344 - reinable building containerinfo plugin for SLES 15 SP4.
- Drop patch now contained in 12.3.0:
  + 0001-build-put-l-specifiers-into-LIBADD-not-LDFLAGS.patch
  + 0002-build-use-grpc-pkgconfig-to-retrieve-flags-libraries.patch
  + 2023-20867-Remove-some-dead-code.patch
  + CVE-20230-20900.patch</changelog>
  <changelog author="meissner@suse.com" date="1695297600">- open-vm-tools is built with containerinfo plugin from 15 sp3 onwards</changelog>
  <changelog author="kallan@suse.com" date="1695902400">- 15 sp4 currently uses open-vm-tools rpms from 15 sp3.  As such, enable
  the spec file fix for bug (bsc#1205927) for 15 sp3 onwards.</changelog>
  <changelog author="kallan@suse.com" date="1697803200">- Fix (bsc#1216432) - VUL-0: CVE-2023-34058: open-vm-tools: SAML token
  signature bypass vulnerability.
- Fix (bsc#1216433) - VUL-0: : CVE-2023-34059: open-vm-tools: file
  descriptor hijack vulnerability
  + Add patch:
  - CVE-2023-34058.patch
  - CVE-2023-34059.patch</changelog>
</package>
<package pkgid="80e844f720c01772bfefc35fff9c7040bf1797a72616695fc383e5de157da7b9" name="opensc" arch="aarch64">
  <version epoch="0" ver="0.22.0" rel="150400.3.6.1"/>
  <changelog author="michael@stroeder.com" date="1424088000">- update to version 0.14.0</changelog>
  <changelog author="bwachter-pkg@lart.info" date="1438257600">- update to version 0.15.0
- register with p11-kit
  (https://www.opensc-project.org/opensc/ticket/390)</changelog>
  <changelog author="t.gruner@katodev.de" date="1467720000">- update to version 0.16.0
- remove fix (issue 505)
- clean up spec-file</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047).
- Drop opensc-ADVISORIES. There is no new advisory since 2009.</changelog>
  <changelog author="tchvatal@suse.com" date="1500379200">- Switch to tarball fetching from github
- Few small cleanups</changelog>
  <changelog author="michael@stroeder.com" date="1514808000">- update to version 0.17.0:
  * support for new cards
  * PIN support enhancemets
  * added .pc file
  * builds with OpenSSL 1.1.0 (1074799)
  * See /usr/share/doc/packages/opensc/NEWS for complete list.</changelog>
  <changelog author="sbrabec@suse.com" date="1531224000">- Update to version 0.18.0:
  * Further improvements of PIN support.
  * Large number of improvements and fixes
    (boo#1097951, boo#1100501).
  * See /usr/share/doc/packages/opensc/NEWS for complete list.
- Add opensc-desktop.patch, opensc-desktop2.patch and
  opensc-bash-completions.patch.</changelog>
  <changelog author="kbabioch@suse.com" date="1536840000">- Update to version 0.19.0
  * Fixed multiple security problems (out of bound writes/reads):
  * bsc#1104812
  * CVE-2018-16391 (bsc#1106998)
  * CVE-2018-16392 (bsc#1106999)
  * CVE-2018-16393 (bsc#1108318)
  * CVE-2018-16418 (bsc#1107039)
  * CVE-2018-16419 (bsc#1107107)
  * CVE-2018-16420 (bsc#1107097)
  * CVE-2018-16421 (bsc#1107049)
  * CVE-2018-16422 (bsc#1107038)
  * CVE-2018-16423 (bsc#1107037)
  * CVE-2018-16424 (bsc#1107036)
  * CVE-2018-16425 (bsc#1107035)
  * CVE-2018-16426 (bsc#1107034)
  * CVE-2018-16427 (bsc#1107033)
  * Workaround cards returning short signatures without leading zeroes
  * Distribute minimal opensc.conf
  * `pkcs11_enable_InitToken made` global configuration option
  * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver
    list instead of forcing one driver and skipping vital parts of
    configuration
  * Removed configuration options `zero_ckaid_for_ca_certs`,
    `force_card_driver`, `reopen_debug_file`, `paranoid-memory`
  * Generalized configuration option `ignored_readers`
  * If card initialization fails, continue card detection with other card
    drivers
  * reader-pcsc: allow fixing the length of a PIN
  * fixed crash during `C_WaitForSlotEvent`
  * Allow cancelling the PIN pad prompt before starting the reader transaction.
    Whether to start the transaction immediately or not is user-configurable
    for each application
  * opensc-notify
  * add Exit button to tray icon
  * User better description (GenericName) and a generic application icon
  * Do not display in the application list
- Removed patches included upstream now:
  * opensc-desktop.patch
  * opensc-desktop2.patch
  * opensc-bash-completions.patch
- Applied spec-cleaner</changelog>
  <changelog author="code@bnavigator.de" date="1563883200">- add explicit BuildRequires: zlib-devel</changelog>
  <changelog author="jsikes@suse.de" date="1564488000">- added opensc-0.19.0-rsa-pss.patch
  * Fixes the pkcs11-tool example
  * Added missing CKM_SHA224_RSA_PKCS_PSS
  * Add support for PSS padding to RSA signatures
  * Support for signature verification in pkcs11-tool
  * Switch cleanup steps to avoid segfaults on errors and more sanity checking
- added opensc-0.19.0-redundant_logging.patch
  * Remove redundant debug output</changelog>
  <changelog author="jsikes@suse.com" date="1566129600">- added opensc-0.19.0-piv_card_matching.patch
  * Improve Card Matching for Dual CAC/PIV and PIVKEY cards.
  * sourced from https://github.com/OpenSC/OpenSC/pull/1549</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1606478400">- OpenSC 0.21.0:
  * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK
    smart card software driver (boo#1177380)
  * CVE-2020-26572: stack-based buffer overflow in the TCOS smart
    card software driver (boo#1177378)
  * CVE-2020-26570: heap-based buffer overflow in the Oberthur
    smart card software driver (boo#1177364)
  * CardOS 5.x support boo#1179291
  * Support for OAEP encryption, make SHA256 default
  * New separate debug level for PIN commands
  * Fix handling of card/reader insertion/removal events in pcscd
  * Fixes of removed readers handling
  * Fix Firefox crash because of invalid pcsc context
  * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards
  * Propagate ignore_user_content to PKCS#11 layer not to confuse applications
  * Minidriver: Fix check of ATR length (2-to 33 characters inclusive)
  * pkcs11-tool: allow using SW tokens
  * opensc-explorer asn1 accepts offsets and decode records
  * opensc-explorer cat accepts records
  * OpenPGP: Add new ec curves supported by GNUK
  * First steps supporting OpenPGP 3.4
  * OpenPGP: Add support for EC key import
  * Rutoken: Add ATR for Rutoken ECP SC NFC
  * Improve detection of various CardOS 5 configurations
  * DNIe: Add new DNIe CA structure for the secure channel
  * ePass2003: Improve ECC support
  * ePass2003: Fix erase sequence
  * IAS-ECC: Fix support for Idemia Cosmo cards
  * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available
  * IAS-ECC: Added PIN-pad support for PIN unblock
  * New driver for Gemalto IDPrime (only some types)
  * eDo: New driver with initial support for Polish eID card (e-dowód, eDO)
  * MCRD: Remove unused and broken RSA EstEID support
  * TCOS: Add missing encryption certificates
  * PIV: Add ATR of DOD Yubikey
  * fixed PIV global pin bug
  * CAC1: Support changing PIN with CAC Alt tokens
- includes changes from 0.20.0
  * CVE-2019-6502: memory leak in libopensc (boo#1122756)
  * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747)
  * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746)
  * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256)
  * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307)
  * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809)
  * Support RSA-PSS signature mechanisms using RSA-RAW
  * Added memory locking for secrets
  * added support for terminal colors
  * PC/SC driver: Fixed error handling in case of changing or removing the card reader
  * rename md_read_only to read_only and use it for PKCS#11 and Minidriver
  * allow global use of ignore_private_certificate
  * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile
  * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations
  * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects
  * PKCS#11: Truncate long PKCS#11 labels with ...
  * PKCS#11: Fixed recognition of a token when being unplugged and reinserted
  * Minidriver: Register for CardOS5 cards
  * Minidriver: Add support for RSA-PSS
  * tools: Harmonize the use of option -r/--reader
  * goid-tool: GoID personalization with fingerprint
  * openpgp-tool: replace the options -L/--key-length with -t/--key-type
  * openpgp-tool: add options -C/--card-info and -K/--key-info
  * opensc-explorer: add command pin_info, extend random
  * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11
  * pkcd11-register: Autostart
  * opensc-tool: Show ATR also for cards not recognized by OpenSC
  * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters
  * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values
  * pkcs11-tool: Support for signature verification via --verify
  * pkcs11-tool: Add object type secrkey for --type option
  * pkcs11-tool: Implement Secret Key write object
  * pkcs11-tool: Add GOSTR3410-2012 support
  * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP
  * pkcs11-tool: Add extractable option to key import
  * pkcs11-tool: list more key access flags when listing keys
  * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys
  * pkcs15-crypt: *Handle keys with user consent
  * New separate CAC1 driver using the old CAC specification (#1502)
  * CardOS: Add support for 4K RSA keys in CardOS 5
  * CardOS: Fixed decryption with CardOS 5
  * Enable CoolKey driver to handle 2048-bit keys
  * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018
  * GIDS Decipher fix (#1881)
  * GIDS: Allow RSA 4K support
  * MICARDO: Remove long expired EstEID 1.0/1.1 card support
  * MyEID: Add support for unwrapping a secret key with an RSA key or secret key
  * MyEID Add support for wrapping a secret key with a secret key
  * Support for MyEID 4K RSA
  * Support for OsEID
  * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys
  * OpenPGP Card v3 ECC support
  * Add Rutoken ECP SC
  * Add Rutoken Lite
  * Add SmartCard-HSM 4K ATR
  * Add missing secp384r1 curve parameter
  * Stacros: Fix decipher with 2.3
  * Stacros: Add ATR for 2nd gen. eGK
  * Stacros: Add new ATR for 3.5
  * Stacros: Detect and allow Globalplatform PIN encoding
  * Fix TCOS IDKey support
  * TCOS: add encryption certificate for IDKey
  * Infocamere, Postecert, Cnipa: Remove profiles
  * Remove incomplete acos5 driver
- drop patches now upstream:
  * opensc-0.19.0-piv_card_matching.patch
  * opensc-0.19.0-redundant_logging.patch
  * opensc-0.19.0-rsa-pss.patch</changelog>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="predivan@mts.rs" date="1624795200">- Fix build on GCC11
  * Add opensc-gcc11.patch from Fedora
    (https://github.com/OpenSC/OpenSC/pull/2241/)</changelog>
  <changelog author="daniel.donisa@suse.com" date="1633348800">- Update to OpenSC 0.22.0:
  * Removed changes in opensc-gcc11.patch already present in upstream.
  - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda
  * Removed some false positives from the openrc-rpmlintrc file.
  * Use standard paths for file cache on Linux (#2148) and OSX (#2214)
  * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic)
  * Add threading test to `pkcs11-tool` (#2067)
  * Add support to generate generic secret keys (#2140)
  * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195)
  * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179).
  * Support for gcc11 and its new strict aliasing rules (#2241, #2260)
  * Initial support for building with OpenSSL 3.0 (#2343)
  * pkcs15-tool: Write data objects in binary mode (#2324)
  * Avoid limited size of log messages (#2352)
  * Support for ECDSA verification (#2211)
  * Support for ECDSA with different SHA hashes (#2190)
  * Prevent issues in p11-kit by not returning unexpected return codes (#2207)
  * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293)
  * Standardize the version 2 on 2.20 in the code (#2096)
  * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE  (#2176)
  * Copy arguments of C_Initialize (#2350)
  * Fix RSA-PSS signing (#2234)
  * Fix DO deletion (#2215)
  * Add support for (X)EdDSA keys (#1960)
  * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205)
  * Add support for applet version 4 (#2332)
  * New configuration option for opensc.conf to disable pkcs1_padding (#2193)
  * Add support for ECDSA with different hashes (#2190)
  * Enable more mechanisms (#2178)
  * Fixed asking for a user pin when formatting a card (#1737)
  * Added support for French CPx Healthcare cards (#2217)
  * Added ATR for new CardOS 5.4 version (#2296)
  * Fixes security issues:
  * tcos: use after return (bsc#1192005, CVE-2021-42780)
  * oberthur: use after free (bsc#1191992, CVE-2021-42779)
  * oberthur: multiple heap buffer overflows (bsc#1192000,
    CVE-2021-42781)
  * multiple stack buffer overflow issues (bsc#1191957,
    CVE-2021-42782)</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685620800">- Security Fix: [CVE-2023-2977, bsc#1211894]
  * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package()
  * Add opensc-CVE-2023-2977.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696420800">- Security Fix: [CVE-2023-40660, bsc#1215762]
  * opensc: PIN bypass when card tracks its own login state
  * Add patches:
  - patches/opensc-0_22_0-CVE-2023-40660-1of2.patch
  - patches/opensc-0_22_0-CVE-2023-40660-2of2.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696593600">- Security Fix: [CVE-2023-40661, bsc#1215761]
  * opensc: multiple memory issues with pkcs15-init (enrollment tool)
  * Add patches:
  - opensc-CVE-2023-40661-1of12.patch
  - opensc-CVE-2023-40661-2of12.patch
  - opensc-CVE-2023-40661-3of12.patch
  - opensc-CVE-2023-40661-4of12.patch
  - opensc-CVE-2023-40661-5of12.patch
  - opensc-CVE-2023-40661-6of12.patch
  - opensc-CVE-2023-40661-7of12.patch
  - opensc-CVE-2023-40661-8of12.patch
  - opensc-CVE-2023-40661-9of12.patch
  - opensc-CVE-2023-40661-10of12.patch
  - opensc-CVE-2023-40661-11of12.patch
  - opensc-CVE-2023-40661-12of12.patch</changelog>
</package>
<package pkgid="9ce6d260f3651309d75c7e21501cea4973ec12582bcd92e73ceb831688724a16" name="opensc" arch="s390x">
  <version epoch="0" ver="0.22.0" rel="150400.3.6.1"/>
  <changelog author="michael@stroeder.com" date="1424088000">- update to version 0.14.0</changelog>
  <changelog author="bwachter-pkg@lart.info" date="1438257600">- update to version 0.15.0
- register with p11-kit
  (https://www.opensc-project.org/opensc/ticket/390)</changelog>
  <changelog author="t.gruner@katodev.de" date="1467720000">- update to version 0.16.0
- remove fix (issue 505)
- clean up spec-file</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047).
- Drop opensc-ADVISORIES. There is no new advisory since 2009.</changelog>
  <changelog author="tchvatal@suse.com" date="1500379200">- Switch to tarball fetching from github
- Few small cleanups</changelog>
  <changelog author="michael@stroeder.com" date="1514808000">- update to version 0.17.0:
  * support for new cards
  * PIN support enhancemets
  * added .pc file
  * builds with OpenSSL 1.1.0 (1074799)
  * See /usr/share/doc/packages/opensc/NEWS for complete list.</changelog>
  <changelog author="sbrabec@suse.com" date="1531224000">- Update to version 0.18.0:
  * Further improvements of PIN support.
  * Large number of improvements and fixes
    (boo#1097951, boo#1100501).
  * See /usr/share/doc/packages/opensc/NEWS for complete list.
- Add opensc-desktop.patch, opensc-desktop2.patch and
  opensc-bash-completions.patch.</changelog>
  <changelog author="kbabioch@suse.com" date="1536840000">- Update to version 0.19.0
  * Fixed multiple security problems (out of bound writes/reads):
  * bsc#1104812
  * CVE-2018-16391 (bsc#1106998)
  * CVE-2018-16392 (bsc#1106999)
  * CVE-2018-16393 (bsc#1108318)
  * CVE-2018-16418 (bsc#1107039)
  * CVE-2018-16419 (bsc#1107107)
  * CVE-2018-16420 (bsc#1107097)
  * CVE-2018-16421 (bsc#1107049)
  * CVE-2018-16422 (bsc#1107038)
  * CVE-2018-16423 (bsc#1107037)
  * CVE-2018-16424 (bsc#1107036)
  * CVE-2018-16425 (bsc#1107035)
  * CVE-2018-16426 (bsc#1107034)
  * CVE-2018-16427 (bsc#1107033)
  * Workaround cards returning short signatures without leading zeroes
  * Distribute minimal opensc.conf
  * `pkcs11_enable_InitToken made` global configuration option
  * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver
    list instead of forcing one driver and skipping vital parts of
    configuration
  * Removed configuration options `zero_ckaid_for_ca_certs`,
    `force_card_driver`, `reopen_debug_file`, `paranoid-memory`
  * Generalized configuration option `ignored_readers`
  * If card initialization fails, continue card detection with other card
    drivers
  * reader-pcsc: allow fixing the length of a PIN
  * fixed crash during `C_WaitForSlotEvent`
  * Allow cancelling the PIN pad prompt before starting the reader transaction.
    Whether to start the transaction immediately or not is user-configurable
    for each application
  * opensc-notify
  * add Exit button to tray icon
  * User better description (GenericName) and a generic application icon
  * Do not display in the application list
- Removed patches included upstream now:
  * opensc-desktop.patch
  * opensc-desktop2.patch
  * opensc-bash-completions.patch
- Applied spec-cleaner</changelog>
  <changelog author="code@bnavigator.de" date="1563883200">- add explicit BuildRequires: zlib-devel</changelog>
  <changelog author="jsikes@suse.de" date="1564488000">- added opensc-0.19.0-rsa-pss.patch
  * Fixes the pkcs11-tool example
  * Added missing CKM_SHA224_RSA_PKCS_PSS
  * Add support for PSS padding to RSA signatures
  * Support for signature verification in pkcs11-tool
  * Switch cleanup steps to avoid segfaults on errors and more sanity checking
- added opensc-0.19.0-redundant_logging.patch
  * Remove redundant debug output</changelog>
  <changelog author="jsikes@suse.com" date="1566129600">- added opensc-0.19.0-piv_card_matching.patch
  * Improve Card Matching for Dual CAC/PIV and PIVKEY cards.
  * sourced from https://github.com/OpenSC/OpenSC/pull/1549</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1606478400">- OpenSC 0.21.0:
  * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK
    smart card software driver (boo#1177380)
  * CVE-2020-26572: stack-based buffer overflow in the TCOS smart
    card software driver (boo#1177378)
  * CVE-2020-26570: heap-based buffer overflow in the Oberthur
    smart card software driver (boo#1177364)
  * CardOS 5.x support boo#1179291
  * Support for OAEP encryption, make SHA256 default
  * New separate debug level for PIN commands
  * Fix handling of card/reader insertion/removal events in pcscd
  * Fixes of removed readers handling
  * Fix Firefox crash because of invalid pcsc context
  * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards
  * Propagate ignore_user_content to PKCS#11 layer not to confuse applications
  * Minidriver: Fix check of ATR length (2-to 33 characters inclusive)
  * pkcs11-tool: allow using SW tokens
  * opensc-explorer asn1 accepts offsets and decode records
  * opensc-explorer cat accepts records
  * OpenPGP: Add new ec curves supported by GNUK
  * First steps supporting OpenPGP 3.4
  * OpenPGP: Add support for EC key import
  * Rutoken: Add ATR for Rutoken ECP SC NFC
  * Improve detection of various CardOS 5 configurations
  * DNIe: Add new DNIe CA structure for the secure channel
  * ePass2003: Improve ECC support
  * ePass2003: Fix erase sequence
  * IAS-ECC: Fix support for Idemia Cosmo cards
  * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available
  * IAS-ECC: Added PIN-pad support for PIN unblock
  * New driver for Gemalto IDPrime (only some types)
  * eDo: New driver with initial support for Polish eID card (e-dowód, eDO)
  * MCRD: Remove unused and broken RSA EstEID support
  * TCOS: Add missing encryption certificates
  * PIV: Add ATR of DOD Yubikey
  * fixed PIV global pin bug
  * CAC1: Support changing PIN with CAC Alt tokens
- includes changes from 0.20.0
  * CVE-2019-6502: memory leak in libopensc (boo#1122756)
  * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747)
  * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746)
  * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256)
  * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307)
  * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809)
  * Support RSA-PSS signature mechanisms using RSA-RAW
  * Added memory locking for secrets
  * added support for terminal colors
  * PC/SC driver: Fixed error handling in case of changing or removing the card reader
  * rename md_read_only to read_only and use it for PKCS#11 and Minidriver
  * allow global use of ignore_private_certificate
  * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile
  * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations
  * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects
  * PKCS#11: Truncate long PKCS#11 labels with ...
  * PKCS#11: Fixed recognition of a token when being unplugged and reinserted
  * Minidriver: Register for CardOS5 cards
  * Minidriver: Add support for RSA-PSS
  * tools: Harmonize the use of option -r/--reader
  * goid-tool: GoID personalization with fingerprint
  * openpgp-tool: replace the options -L/--key-length with -t/--key-type
  * openpgp-tool: add options -C/--card-info and -K/--key-info
  * opensc-explorer: add command pin_info, extend random
  * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11
  * pkcd11-register: Autostart
  * opensc-tool: Show ATR also for cards not recognized by OpenSC
  * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters
  * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values
  * pkcs11-tool: Support for signature verification via --verify
  * pkcs11-tool: Add object type secrkey for --type option
  * pkcs11-tool: Implement Secret Key write object
  * pkcs11-tool: Add GOSTR3410-2012 support
  * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP
  * pkcs11-tool: Add extractable option to key import
  * pkcs11-tool: list more key access flags when listing keys
  * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys
  * pkcs15-crypt: *Handle keys with user consent
  * New separate CAC1 driver using the old CAC specification (#1502)
  * CardOS: Add support for 4K RSA keys in CardOS 5
  * CardOS: Fixed decryption with CardOS 5
  * Enable CoolKey driver to handle 2048-bit keys
  * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018
  * GIDS Decipher fix (#1881)
  * GIDS: Allow RSA 4K support
  * MICARDO: Remove long expired EstEID 1.0/1.1 card support
  * MyEID: Add support for unwrapping a secret key with an RSA key or secret key
  * MyEID Add support for wrapping a secret key with a secret key
  * Support for MyEID 4K RSA
  * Support for OsEID
  * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys
  * OpenPGP Card v3 ECC support
  * Add Rutoken ECP SC
  * Add Rutoken Lite
  * Add SmartCard-HSM 4K ATR
  * Add missing secp384r1 curve parameter
  * Stacros: Fix decipher with 2.3
  * Stacros: Add ATR for 2nd gen. eGK
  * Stacros: Add new ATR for 3.5
  * Stacros: Detect and allow Globalplatform PIN encoding
  * Fix TCOS IDKey support
  * TCOS: add encryption certificate for IDKey
  * Infocamere, Postecert, Cnipa: Remove profiles
  * Remove incomplete acos5 driver
- drop patches now upstream:
  * opensc-0.19.0-piv_card_matching.patch
  * opensc-0.19.0-redundant_logging.patch
  * opensc-0.19.0-rsa-pss.patch</changelog>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="predivan@mts.rs" date="1624795200">- Fix build on GCC11
  * Add opensc-gcc11.patch from Fedora
    (https://github.com/OpenSC/OpenSC/pull/2241/)</changelog>
  <changelog author="daniel.donisa@suse.com" date="1633348800">- Update to OpenSC 0.22.0:
  * Removed changes in opensc-gcc11.patch already present in upstream.
  - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda
  * Removed some false positives from the openrc-rpmlintrc file.
  * Use standard paths for file cache on Linux (#2148) and OSX (#2214)
  * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic)
  * Add threading test to `pkcs11-tool` (#2067)
  * Add support to generate generic secret keys (#2140)
  * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195)
  * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179).
  * Support for gcc11 and its new strict aliasing rules (#2241, #2260)
  * Initial support for building with OpenSSL 3.0 (#2343)
  * pkcs15-tool: Write data objects in binary mode (#2324)
  * Avoid limited size of log messages (#2352)
  * Support for ECDSA verification (#2211)
  * Support for ECDSA with different SHA hashes (#2190)
  * Prevent issues in p11-kit by not returning unexpected return codes (#2207)
  * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293)
  * Standardize the version 2 on 2.20 in the code (#2096)
  * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE  (#2176)
  * Copy arguments of C_Initialize (#2350)
  * Fix RSA-PSS signing (#2234)
  * Fix DO deletion (#2215)
  * Add support for (X)EdDSA keys (#1960)
  * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205)
  * Add support for applet version 4 (#2332)
  * New configuration option for opensc.conf to disable pkcs1_padding (#2193)
  * Add support for ECDSA with different hashes (#2190)
  * Enable more mechanisms (#2178)
  * Fixed asking for a user pin when formatting a card (#1737)
  * Added support for French CPx Healthcare cards (#2217)
  * Added ATR for new CardOS 5.4 version (#2296)
  * Fixes security issues:
  * tcos: use after return (bsc#1192005, CVE-2021-42780)
  * oberthur: use after free (bsc#1191992, CVE-2021-42779)
  * oberthur: multiple heap buffer overflows (bsc#1192000,
    CVE-2021-42781)
  * multiple stack buffer overflow issues (bsc#1191957,
    CVE-2021-42782)</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685620800">- Security Fix: [CVE-2023-2977, bsc#1211894]
  * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package()
  * Add opensc-CVE-2023-2977.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696420800">- Security Fix: [CVE-2023-40660, bsc#1215762]
  * opensc: PIN bypass when card tracks its own login state
  * Add patches:
  - patches/opensc-0_22_0-CVE-2023-40660-1of2.patch
  - patches/opensc-0_22_0-CVE-2023-40660-2of2.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696593600">- Security Fix: [CVE-2023-40661, bsc#1215761]
  * opensc: multiple memory issues with pkcs15-init (enrollment tool)
  * Add patches:
  - opensc-CVE-2023-40661-1of12.patch
  - opensc-CVE-2023-40661-2of12.patch
  - opensc-CVE-2023-40661-3of12.patch
  - opensc-CVE-2023-40661-4of12.patch
  - opensc-CVE-2023-40661-5of12.patch
  - opensc-CVE-2023-40661-6of12.patch
  - opensc-CVE-2023-40661-7of12.patch
  - opensc-CVE-2023-40661-8of12.patch
  - opensc-CVE-2023-40661-9of12.patch
  - opensc-CVE-2023-40661-10of12.patch
  - opensc-CVE-2023-40661-11of12.patch
  - opensc-CVE-2023-40661-12of12.patch</changelog>
</package>
<package pkgid="a92abbecd97b743968bef98078c7ee1ab42e453128ef9729a4ecd8b19b0f8dc5" name="opensc" arch="src">
  <version epoch="0" ver="0.22.0" rel="150400.3.6.1"/>
  <changelog author="mgorse@suse.com" date="1339502400">- make needed directories before running make install</changelog>
  <changelog author="luizluca@tre-sc.gov.br" date="1386072000">- update to version 0.13.0</changelog>
  <changelog author="michael@stroeder.com" date="1424088000">- update to version 0.14.0</changelog>
  <changelog author="bwachter-pkg@lart.info" date="1438257600">- update to version 0.15.0
- register with p11-kit
  (https://www.opensc-project.org/opensc/ticket/390)</changelog>
  <changelog author="t.gruner@katodev.de" date="1467720000">- update to version 0.16.0
- remove fix (issue 505)
- clean up spec-file</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047).
- Drop opensc-ADVISORIES. There is no new advisory since 2009.</changelog>
  <changelog author="tchvatal@suse.com" date="1500379200">- Switch to tarball fetching from github
- Few small cleanups</changelog>
  <changelog author="michael@stroeder.com" date="1514808000">- update to version 0.17.0:
  * support for new cards
  * PIN support enhancemets
  * added .pc file
  * builds with OpenSSL 1.1.0 (1074799)
  * See /usr/share/doc/packages/opensc/NEWS for complete list.</changelog>
  <changelog author="sbrabec@suse.com" date="1531224000">- Update to version 0.18.0:
  * Further improvements of PIN support.
  * Large number of improvements and fixes
    (boo#1097951, boo#1100501).
  * See /usr/share/doc/packages/opensc/NEWS for complete list.
- Add opensc-desktop.patch, opensc-desktop2.patch and
  opensc-bash-completions.patch.</changelog>
  <changelog author="kbabioch@suse.com" date="1536840000">- Update to version 0.19.0
  * Fixed multiple security problems (out of bound writes/reads):
  * bsc#1104812
  * CVE-2018-16391 (bsc#1106998)
  * CVE-2018-16392 (bsc#1106999)
  * CVE-2018-16393 (bsc#1108318)
  * CVE-2018-16418 (bsc#1107039)
  * CVE-2018-16419 (bsc#1107107)
  * CVE-2018-16420 (bsc#1107097)
  * CVE-2018-16421 (bsc#1107049)
  * CVE-2018-16422 (bsc#1107038)
  * CVE-2018-16423 (bsc#1107037)
  * CVE-2018-16424 (bsc#1107036)
  * CVE-2018-16425 (bsc#1107035)
  * CVE-2018-16426 (bsc#1107034)
  * CVE-2018-16427 (bsc#1107033)
  * Workaround cards returning short signatures without leading zeroes
  * Distribute minimal opensc.conf
  * `pkcs11_enable_InitToken made` global configuration option
  * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver
    list instead of forcing one driver and skipping vital parts of
    configuration
  * Removed configuration options `zero_ckaid_for_ca_certs`,
    `force_card_driver`, `reopen_debug_file`, `paranoid-memory`
  * Generalized configuration option `ignored_readers`
  * If card initialization fails, continue card detection with other card
    drivers
  * reader-pcsc: allow fixing the length of a PIN
  * fixed crash during `C_WaitForSlotEvent`
  * Allow cancelling the PIN pad prompt before starting the reader transaction.
    Whether to start the transaction immediately or not is user-configurable
    for each application
  * opensc-notify
  * add Exit button to tray icon
  * User better description (GenericName) and a generic application icon
  * Do not display in the application list
- Removed patches included upstream now:
  * opensc-desktop.patch
  * opensc-desktop2.patch
  * opensc-bash-completions.patch
- Applied spec-cleaner</changelog>
  <changelog author="code@bnavigator.de" date="1563883200">- add explicit BuildRequires: zlib-devel</changelog>
  <changelog author="jsikes@suse.de" date="1564488000">- added opensc-0.19.0-rsa-pss.patch
  * Fixes the pkcs11-tool example
  * Added missing CKM_SHA224_RSA_PKCS_PSS
  * Add support for PSS padding to RSA signatures
  * Support for signature verification in pkcs11-tool
  * Switch cleanup steps to avoid segfaults on errors and more sanity checking
- added opensc-0.19.0-redundant_logging.patch
  * Remove redundant debug output</changelog>
  <changelog author="jsikes@suse.com" date="1566129600">- added opensc-0.19.0-piv_card_matching.patch
  * Improve Card Matching for Dual CAC/PIV and PIVKEY cards.
  * sourced from https://github.com/OpenSC/OpenSC/pull/1549</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1606478400">- OpenSC 0.21.0:
  * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK
    smart card software driver (boo#1177380)
  * CVE-2020-26572: stack-based buffer overflow in the TCOS smart
    card software driver (boo#1177378)
  * CVE-2020-26570: heap-based buffer overflow in the Oberthur
    smart card software driver (boo#1177364)
  * CardOS 5.x support boo#1179291
  * Support for OAEP encryption, make SHA256 default
  * New separate debug level for PIN commands
  * Fix handling of card/reader insertion/removal events in pcscd
  * Fixes of removed readers handling
  * Fix Firefox crash because of invalid pcsc context
  * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards
  * Propagate ignore_user_content to PKCS#11 layer not to confuse applications
  * Minidriver: Fix check of ATR length (2-to 33 characters inclusive)
  * pkcs11-tool: allow using SW tokens
  * opensc-explorer asn1 accepts offsets and decode records
  * opensc-explorer cat accepts records
  * OpenPGP: Add new ec curves supported by GNUK
  * First steps supporting OpenPGP 3.4
  * OpenPGP: Add support for EC key import
  * Rutoken: Add ATR for Rutoken ECP SC NFC
  * Improve detection of various CardOS 5 configurations
  * DNIe: Add new DNIe CA structure for the secure channel
  * ePass2003: Improve ECC support
  * ePass2003: Fix erase sequence
  * IAS-ECC: Fix support for Idemia Cosmo cards
  * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available
  * IAS-ECC: Added PIN-pad support for PIN unblock
  * New driver for Gemalto IDPrime (only some types)
  * eDo: New driver with initial support for Polish eID card (e-dowód, eDO)
  * MCRD: Remove unused and broken RSA EstEID support
  * TCOS: Add missing encryption certificates
  * PIV: Add ATR of DOD Yubikey
  * fixed PIV global pin bug
  * CAC1: Support changing PIN with CAC Alt tokens
- includes changes from 0.20.0
  * CVE-2019-6502: memory leak in libopensc (boo#1122756)
  * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747)
  * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746)
  * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256)
  * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307)
  * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809)
  * Support RSA-PSS signature mechanisms using RSA-RAW
  * Added memory locking for secrets
  * added support for terminal colors
  * PC/SC driver: Fixed error handling in case of changing or removing the card reader
  * rename md_read_only to read_only and use it for PKCS#11 and Minidriver
  * allow global use of ignore_private_certificate
  * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile
  * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations
  * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects
  * PKCS#11: Truncate long PKCS#11 labels with ...
  * PKCS#11: Fixed recognition of a token when being unplugged and reinserted
  * Minidriver: Register for CardOS5 cards
  * Minidriver: Add support for RSA-PSS
  * tools: Harmonize the use of option -r/--reader
  * goid-tool: GoID personalization with fingerprint
  * openpgp-tool: replace the options -L/--key-length with -t/--key-type
  * openpgp-tool: add options -C/--card-info and -K/--key-info
  * opensc-explorer: add command pin_info, extend random
  * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11
  * pkcd11-register: Autostart
  * opensc-tool: Show ATR also for cards not recognized by OpenSC
  * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters
  * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values
  * pkcs11-tool: Support for signature verification via --verify
  * pkcs11-tool: Add object type secrkey for --type option
  * pkcs11-tool: Implement Secret Key write object
  * pkcs11-tool: Add GOSTR3410-2012 support
  * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP
  * pkcs11-tool: Add extractable option to key import
  * pkcs11-tool: list more key access flags when listing keys
  * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys
  * pkcs15-crypt: *Handle keys with user consent
  * New separate CAC1 driver using the old CAC specification (#1502)
  * CardOS: Add support for 4K RSA keys in CardOS 5
  * CardOS: Fixed decryption with CardOS 5
  * Enable CoolKey driver to handle 2048-bit keys
  * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018
  * GIDS Decipher fix (#1881)
  * GIDS: Allow RSA 4K support
  * MICARDO: Remove long expired EstEID 1.0/1.1 card support
  * MyEID: Add support for unwrapping a secret key with an RSA key or secret key
  * MyEID Add support for wrapping a secret key with a secret key
  * Support for MyEID 4K RSA
  * Support for OsEID
  * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys
  * OpenPGP Card v3 ECC support
  * Add Rutoken ECP SC
  * Add Rutoken Lite
  * Add SmartCard-HSM 4K ATR
  * Add missing secp384r1 curve parameter
  * Stacros: Fix decipher with 2.3
  * Stacros: Add ATR for 2nd gen. eGK
  * Stacros: Add new ATR for 3.5
  * Stacros: Detect and allow Globalplatform PIN encoding
  * Fix TCOS IDKey support
  * TCOS: add encryption certificate for IDKey
  * Infocamere, Postecert, Cnipa: Remove profiles
  * Remove incomplete acos5 driver
- drop patches now upstream:
  * opensc-0.19.0-piv_card_matching.patch
  * opensc-0.19.0-redundant_logging.patch
  * opensc-0.19.0-rsa-pss.patch</changelog>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="predivan@mts.rs" date="1624795200">- Fix build on GCC11
  * Add opensc-gcc11.patch from Fedora
    (https://github.com/OpenSC/OpenSC/pull/2241/)</changelog>
  <changelog author="daniel.donisa@suse.com" date="1633348800">- Update to OpenSC 0.22.0:
  * Removed changes in opensc-gcc11.patch already present in upstream.
  - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda
  * Removed some false positives from the openrc-rpmlintrc file.
  * Use standard paths for file cache on Linux (#2148) and OSX (#2214)
  * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic)
  * Add threading test to `pkcs11-tool` (#2067)
  * Add support to generate generic secret keys (#2140)
  * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195)
  * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179).
  * Support for gcc11 and its new strict aliasing rules (#2241, #2260)
  * Initial support for building with OpenSSL 3.0 (#2343)
  * pkcs15-tool: Write data objects in binary mode (#2324)
  * Avoid limited size of log messages (#2352)
  * Support for ECDSA verification (#2211)
  * Support for ECDSA with different SHA hashes (#2190)
  * Prevent issues in p11-kit by not returning unexpected return codes (#2207)
  * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293)
  * Standardize the version 2 on 2.20 in the code (#2096)
  * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE  (#2176)
  * Copy arguments of C_Initialize (#2350)
  * Fix RSA-PSS signing (#2234)
  * Fix DO deletion (#2215)
  * Add support for (X)EdDSA keys (#1960)
  * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205)
  * Add support for applet version 4 (#2332)
  * New configuration option for opensc.conf to disable pkcs1_padding (#2193)
  * Add support for ECDSA with different hashes (#2190)
  * Enable more mechanisms (#2178)
  * Fixed asking for a user pin when formatting a card (#1737)
  * Added support for French CPx Healthcare cards (#2217)
  * Added ATR for new CardOS 5.4 version (#2296)
  * Fixes security issues:
  * tcos: use after return (bsc#1192005, CVE-2021-42780)
  * oberthur: use after free (bsc#1191992, CVE-2021-42779)
  * oberthur: multiple heap buffer overflows (bsc#1192000,
    CVE-2021-42781)
  * multiple stack buffer overflow issues (bsc#1191957,
    CVE-2021-42782)</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685620800">- Security Fix: [CVE-2023-2977, bsc#1211894]
  * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package()
  * Add opensc-CVE-2023-2977.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696420800">- Security Fix: [CVE-2023-40660, bsc#1215762]
  * opensc: PIN bypass when card tracks its own login state
  * Add patches:
  - patches/opensc-0_22_0-CVE-2023-40660-1of2.patch
  - patches/opensc-0_22_0-CVE-2023-40660-2of2.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696593600">- Security Fix: [CVE-2023-40661, bsc#1215761]
  * opensc: multiple memory issues with pkcs15-init (enrollment tool)
  * Add patches:
  - opensc-CVE-2023-40661-1of12.patch
  - opensc-CVE-2023-40661-2of12.patch
  - opensc-CVE-2023-40661-3of12.patch
  - opensc-CVE-2023-40661-4of12.patch
  - opensc-CVE-2023-40661-5of12.patch
  - opensc-CVE-2023-40661-6of12.patch
  - opensc-CVE-2023-40661-7of12.patch
  - opensc-CVE-2023-40661-8of12.patch
  - opensc-CVE-2023-40661-9of12.patch
  - opensc-CVE-2023-40661-10of12.patch
  - opensc-CVE-2023-40661-11of12.patch
  - opensc-CVE-2023-40661-12of12.patch</changelog>
</package>
<package pkgid="6d46e2a2a305fb1f77c52a01f983f45af0c541ff8ff568f5b4cb3a3582ac9d93" name="opensc" arch="x86_64">
  <version epoch="0" ver="0.22.0" rel="150400.3.6.1"/>
  <changelog author="michael@stroeder.com" date="1424088000">- update to version 0.14.0</changelog>
  <changelog author="bwachter-pkg@lart.info" date="1438257600">- update to version 0.15.0
- register with p11-kit
  (https://www.opensc-project.org/opensc/ticket/390)</changelog>
  <changelog author="t.gruner@katodev.de" date="1467720000">- update to version 0.16.0
- remove fix (issue 505)
- clean up spec-file</changelog>
  <changelog author="sbrabec@suse.com" date="1479816000">- Add baselibs.conf to provide 32-bit PKCS11 plugins (bsc#996047).
- Drop opensc-ADVISORIES. There is no new advisory since 2009.</changelog>
  <changelog author="tchvatal@suse.com" date="1500379200">- Switch to tarball fetching from github
- Few small cleanups</changelog>
  <changelog author="michael@stroeder.com" date="1514808000">- update to version 0.17.0:
  * support for new cards
  * PIN support enhancemets
  * added .pc file
  * builds with OpenSSL 1.1.0 (1074799)
  * See /usr/share/doc/packages/opensc/NEWS for complete list.</changelog>
  <changelog author="sbrabec@suse.com" date="1531224000">- Update to version 0.18.0:
  * Further improvements of PIN support.
  * Large number of improvements and fixes
    (boo#1097951, boo#1100501).
  * See /usr/share/doc/packages/opensc/NEWS for complete list.
- Add opensc-desktop.patch, opensc-desktop2.patch and
  opensc-bash-completions.patch.</changelog>
  <changelog author="kbabioch@suse.com" date="1536840000">- Update to version 0.19.0
  * Fixed multiple security problems (out of bound writes/reads):
  * bsc#1104812
  * CVE-2018-16391 (bsc#1106998)
  * CVE-2018-16392 (bsc#1106999)
  * CVE-2018-16393 (bsc#1108318)
  * CVE-2018-16418 (bsc#1107039)
  * CVE-2018-16419 (bsc#1107107)
  * CVE-2018-16420 (bsc#1107097)
  * CVE-2018-16421 (bsc#1107049)
  * CVE-2018-16422 (bsc#1107038)
  * CVE-2018-16423 (bsc#1107037)
  * CVE-2018-16424 (bsc#1107036)
  * CVE-2018-16425 (bsc#1107035)
  * CVE-2018-16426 (bsc#1107034)
  * CVE-2018-16427 (bsc#1107033)
  * Workaround cards returning short signatures without leading zeroes
  * Distribute minimal opensc.conf
  * `pkcs11_enable_InitToken made` global configuration option
  * Modify behavior of `OPENSC_DRIVER` environment variable to restrict driver
    list instead of forcing one driver and skipping vital parts of
    configuration
  * Removed configuration options `zero_ckaid_for_ca_certs`,
    `force_card_driver`, `reopen_debug_file`, `paranoid-memory`
  * Generalized configuration option `ignored_readers`
  * If card initialization fails, continue card detection with other card
    drivers
  * reader-pcsc: allow fixing the length of a PIN
  * fixed crash during `C_WaitForSlotEvent`
  * Allow cancelling the PIN pad prompt before starting the reader transaction.
    Whether to start the transaction immediately or not is user-configurable
    for each application
  * opensc-notify
  * add Exit button to tray icon
  * User better description (GenericName) and a generic application icon
  * Do not display in the application list
- Removed patches included upstream now:
  * opensc-desktop.patch
  * opensc-desktop2.patch
  * opensc-bash-completions.patch
- Applied spec-cleaner</changelog>
  <changelog author="code@bnavigator.de" date="1563883200">- add explicit BuildRequires: zlib-devel</changelog>
  <changelog author="jsikes@suse.de" date="1564488000">- added opensc-0.19.0-rsa-pss.patch
  * Fixes the pkcs11-tool example
  * Added missing CKM_SHA224_RSA_PKCS_PSS
  * Add support for PSS padding to RSA signatures
  * Support for signature verification in pkcs11-tool
  * Switch cleanup steps to avoid segfaults on errors and more sanity checking
- added opensc-0.19.0-redundant_logging.patch
  * Remove redundant debug output</changelog>
  <changelog author="jsikes@suse.com" date="1566129600">- added opensc-0.19.0-piv_card_matching.patch
  * Improve Card Matching for Dual CAC/PIV and PIVKEY cards.
  * sourced from https://github.com/OpenSC/OpenSC/pull/1549</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1606478400">- OpenSC 0.21.0:
  * CVE-2020-26571: stack-based buffer overflow in the gemsafe GPK
    smart card software driver (boo#1177380)
  * CVE-2020-26572: stack-based buffer overflow in the TCOS smart
    card software driver (boo#1177378)
  * CVE-2020-26570: heap-based buffer overflow in the Oberthur
    smart card software driver (boo#1177364)
  * CardOS 5.x support boo#1179291
  * Support for OAEP encryption, make SHA256 default
  * New separate debug level for PIN commands
  * Fix handling of card/reader insertion/removal events in pcscd
  * Fixes of removed readers handling
  * Fix Firefox crash because of invalid pcsc context
  * PKCS#11: Return CKR_TOKEN_NOT_RECOGNIZED for not recognized cards
  * Propagate ignore_user_content to PKCS#11 layer not to confuse applications
  * Minidriver: Fix check of ATR length (2-to 33 characters inclusive)
  * pkcs11-tool: allow using SW tokens
  * opensc-explorer asn1 accepts offsets and decode records
  * opensc-explorer cat accepts records
  * OpenPGP: Add new ec curves supported by GNUK
  * First steps supporting OpenPGP 3.4
  * OpenPGP: Add support for EC key import
  * Rutoken: Add ATR for Rutoken ECP SC NFC
  * Improve detection of various CardOS 5 configurations
  * DNIe: Add new DNIe CA structure for the secure channel
  * ePass2003: Improve ECC support
  * ePass2003: Fix erase sequence
  * IAS-ECC: Fix support for Idemia Cosmo cards
  * IAS-ECC: PIN padding settings are now used from PKCS#15 info when available
  * IAS-ECC: Added PIN-pad support for PIN unblock
  * New driver for Gemalto IDPrime (only some types)
  * eDo: New driver with initial support for Polish eID card (e-dowód, eDO)
  * MCRD: Remove unused and broken RSA EstEID support
  * TCOS: Add missing encryption certificates
  * PIV: Add ATR of DOD Yubikey
  * fixed PIV global pin bug
  * CAC1: Support changing PIN with CAC Alt tokens
- includes changes from 0.20.0
  * CVE-2019-6502: memory leak in libopensc (boo#1122756)
  * CVE-2019-15946: out-of-bounds access of an ASN.1 Octet string (boo#1149747)
  * CVE-2019-15945: out-of-bounds access of an ASN.1 Bitstring (boo#1149746)
  * CVE-2019-19479: incorrect read operation during parsing of a SETCOS file attribute (boo#1158256)
  * CVE-2019-19480: improper free operation in sc_pkcs15_decode_prkdf_entry (boo#1158307)
  * CVE-2019-20792: double free in coolkey_free_private_dat (bsc#1170809)
  * Support RSA-PSS signature mechanisms using RSA-RAW
  * Added memory locking for secrets
  * added support for terminal colors
  * PC/SC driver: Fixed error handling in case of changing or removing the card reader
  * rename md_read_only to read_only and use it for PKCS#11 and Minidriver
  * allow global use of ignore_private_certificate
  * PKCS#11: Implement write protection (CKF_WRITE_PROTECTED) based on the card profile
  * PKCS#11: Add C_WrapKey and C_UnwrapKey implementations
  * PKCS#11: Handle CKA_ALWAYS_AUTHENTICATE when creating key objects
  * PKCS#11: Truncate long PKCS#11 labels with ...
  * PKCS#11: Fixed recognition of a token when being unplugged and reinserted
  * Minidriver: Register for CardOS5 cards
  * Minidriver: Add support for RSA-PSS
  * tools: Harmonize the use of option -r/--reader
  * goid-tool: GoID personalization with fingerprint
  * openpgp-tool: replace the options -L/--key-length with -t/--key-type
  * openpgp-tool: add options -C/--card-info and -K/--key-info
  * opensc-explorer: add command pin_info, extend random
  * pkcs11-register: Auto-configuration of applications for use of OpenSC PKCS#11
  * pkcd11-register: Autostart
  * opensc-tool: Show ATR also for cards not recognized by OpenSC
  * pkcs11-spy: parse CKM_AES_GCM, EC Derive parameters
  * pkcs11-spy: Add support for CKA_OTP_* and CKM_*_PSS values
  * pkcs11-tool: Support for signature verification via --verify
  * pkcs11-tool: Add object type secrkey for --type option
  * pkcs11-tool: Implement Secret Key write object
  * pkcs11-tool: Add GOSTR3410-2012 support
  * pkcs11-tool: Add support for testing CKM_RSA_PKCS_OAEP
  * pkcs11-tool: Add extractable option to key import
  * pkcs11-tool: list more key access flags when listing keys
  * pkcs11-tool: Add support for CKA_ALLOWED_MECHANISMS when creating new objects and listing keys
  * pkcs15-crypt: *Handle keys with user consent
  * New separate CAC1 driver using the old CAC specification (#1502)
  * CardOS: Add support for 4K RSA keys in CardOS 5
  * CardOS: Fixed decryption with CardOS 5
  * Enable CoolKey driver to handle 2048-bit keys
  * EstEID: add support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018
  * GIDS Decipher fix (#1881)
  * GIDS: Allow RSA 4K support
  * MICARDO: Remove long expired EstEID 1.0/1.1 card support
  * MyEID: Add support for unwrapping a secret key with an RSA key or secret key
  * MyEID Add support for wrapping a secret key with a secret key
  * Support for MyEID 4K RSA
  * Support for OsEID
  * Gemalto GemSafe: add new PTeID ATRs, add support for 4K RSA keys
  * OpenPGP Card v3 ECC support
  * Add Rutoken ECP SC
  * Add Rutoken Lite
  * Add SmartCard-HSM 4K ATR
  * Add missing secp384r1 curve parameter
  * Stacros: Fix decipher with 2.3
  * Stacros: Add ATR for 2nd gen. eGK
  * Stacros: Add new ATR for 3.5
  * Stacros: Detect and allow Globalplatform PIN encoding
  * Fix TCOS IDKey support
  * TCOS: add encryption certificate for IDKey
  * Infocamere, Postecert, Cnipa: Remove profiles
  * Remove incomplete acos5 driver
- drop patches now upstream:
  * opensc-0.19.0-piv_card_matching.patch
  * opensc-0.19.0-redundant_logging.patch
  * opensc-0.19.0-rsa-pss.patch</changelog>
  <changelog author="dmueller@suse.com" date="1615550400">- move licenses to licensedir</changelog>
  <changelog author="predivan@mts.rs" date="1624795200">- Fix build on GCC11
  * Add opensc-gcc11.patch from Fedora
    (https://github.com/OpenSC/OpenSC/pull/2241/)</changelog>
  <changelog author="daniel.donisa@suse.com" date="1633348800">- Update to OpenSC 0.22.0:
  * Removed changes in opensc-gcc11.patch already present in upstream.
  - See https://github.com/OpenSC/OpenSC/pull/2241/commits/e549e9c62eb4fcd2260800e2665071e4dd9bbbda
  * Removed some false positives from the openrc-rpmlintrc file.
  * Use standard paths for file cache on Linux (#2148) and OSX (#2214)
  * Various issues of memory/buffer handling in legacy drivers mostly reported by oss-fuzz and coverity (tcos, oberthur, isoapplet, iasecc, westcos, gpk, flex, dnie, mcrd, authentic, belpic)
  * Add threading test to `pkcs11-tool` (#2067)
  * Add support to generate generic secret keys (#2140)
  * `opensc-explorer`: Print information about LCS (Life cycle status byte) (#2195)
  * Add support for Apple's arm64 (M1) binaries, removed TokenD. A seperate installer with TokenD (and without arm64 binaries) will be available (#2179).
  * Support for gcc11 and its new strict aliasing rules (#2241, #2260)
  * Initial support for building with OpenSSL 3.0 (#2343)
  * pkcs15-tool: Write data objects in binary mode (#2324)
  * Avoid limited size of log messages (#2352)
  * Support for ECDSA verification (#2211)
  * Support for ECDSA with different SHA hashes (#2190)
  * Prevent issues in p11-kit by not returning unexpected return codes (#2207)
  * Add support for PKCS#11 3.0: The new interfaces, profile objects and functions (#2096, #2293)
  * Standardize the version 2 on 2.20 in the code (#2096)
  * Fix CKA_MODIFIABLE and CKA_EXTRACTABLE  (#2176)
  * Copy arguments of C_Initialize (#2350)
  * Fix RSA-PSS signing (#2234)
  * Fix DO deletion (#2215)
  * Add support for (X)EdDSA keys (#1960)
  * Add support for applet version 3 and fix RSA-PSS mechanisms (#2205)
  * Add support for applet version 4 (#2332)
  * New configuration option for opensc.conf to disable pkcs1_padding (#2193)
  * Add support for ECDSA with different hashes (#2190)
  * Enable more mechanisms (#2178)
  * Fixed asking for a user pin when formatting a card (#1737)
  * Added support for French CPx Healthcare cards (#2217)
  * Added ATR for new CardOS 5.4 version (#2296)
  * Fixes security issues:
  * tcos: use after return (bsc#1192005, CVE-2021-42780)
  * oberthur: use after free (bsc#1191992, CVE-2021-42779)
  * oberthur: multiple heap buffer overflows (bsc#1192000,
    CVE-2021-42781)
  * multiple stack buffer overflow issues (bsc#1191957,
    CVE-2021-42782)</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685620800">- Security Fix: [CVE-2023-2977, bsc#1211894]
  * opensc: out of bounds read in pkcs15 cardos_have_verifyrc_package()
  * Add opensc-CVE-2023-2977.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696420800">- Security Fix: [CVE-2023-40660, bsc#1215762]
  * opensc: PIN bypass when card tracks its own login state
  * Add patches:
  - patches/opensc-0_22_0-CVE-2023-40660-1of2.patch
  - patches/opensc-0_22_0-CVE-2023-40660-2of2.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696593600">- Security Fix: [CVE-2023-40661, bsc#1215761]
  * opensc: multiple memory issues with pkcs15-init (enrollment tool)
  * Add patches:
  - opensc-CVE-2023-40661-1of12.patch
  - opensc-CVE-2023-40661-2of12.patch
  - opensc-CVE-2023-40661-3of12.patch
  - opensc-CVE-2023-40661-4of12.patch
  - opensc-CVE-2023-40661-5of12.patch
  - opensc-CVE-2023-40661-6of12.patch
  - opensc-CVE-2023-40661-7of12.patch
  - opensc-CVE-2023-40661-8of12.patch
  - opensc-CVE-2023-40661-9of12.patch
  - opensc-CVE-2023-40661-10of12.patch
  - opensc-CVE-2023-40661-11of12.patch
  - opensc-CVE-2023-40661-12of12.patch</changelog>
</package>
<package pkgid="9032de71e0e75bc38314d7318bbee57a365aa1ac31114b1c039f85af93171183" name="openssl-1_1" arch="aarch64">
  <version epoch="0" ver="1.1.1l" rel="150500.17.19.1"/>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1669982400">- POWER10 performance enhancements for cryptography [jsc#PED-512]
  * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch
  * openssl-1_1-Fixed-counter-overflow.patch
  * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch
  * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch
  * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">- FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685534400">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1686744000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Reworked the Fix for the Timing Oracle in RSA Decryption
    The previous fix for this timing side channel turned out to cause
    a severe 2-3x performance regression in the typical use case
    compared to 1.1.1s.
  * Add openssl-CVE-2022-4304.patch
  * Removed patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch
  * Refreshed patches:
  - openssl-CVE-2023-0464.patch
  - openssl-CVE-2023-0465.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1689854400">- Security fix: [bsc#1213487, CVE-2023-3446]
  * Fix DH_check() excessive time with over sized modulus.
  * The function DH_check() performs various checks on DH parameters.
    One of those checks confirms that the modulus ("p" parameter) is
    not too large. Trying to use a very large modulus is slow and
    OpenSSL will not normally use a modulus which is over 10,000 bits
    in length.
    However the DH_check() function checks numerous aspects of the
    key or parameters that have been supplied. Some of those checks
    use the supplied modulus value even if it has already been found
    to be too large.
    A new limit has been added to DH_check of 32,768 bits. Supplying
    a key/parameters with a modulus over this size will simply cause
    DH_check() to fail.
  * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1690200000">- Dont pass zero length input to EVP_Cipher because assembler
  optimized AES cannot handle zero size. [bsc#1213517]
  * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1690891200">- Security fix: (bsc#1213853, CVE-2023-3817)
  * Fix excessive time spent checking DH q parameter value
    (bsc#1213853, CVE-2023-3817). The function DH_check() performs
    various checks on DH parameters. After fixing CVE-2023-3446 it
    was discovered that a large q parameter value can also trigger
    an overly long computation during some of these checks. A
    correct q value, if present, cannot be larger than the modulus
    p parameter, thus it is unnecessary to perform these checks if
    q is larger than p. If DH_check() is called with such q parameter
    value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
    computationally intensive checks are skipped.
  * Add openssl-1_1-CVE-2023-3817.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696420800">- Displays "fips" in the version string (bsc#1215215)
  * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch</changelog>
</package>
<package pkgid="0cc8b2f67ff94cbc6e0526a898b165c4e0665f220f503152be1e0e4375b0c6f5" name="openssl-1_1" arch="s390x">
  <version epoch="0" ver="1.1.1l" rel="150500.17.19.1"/>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1669982400">- POWER10 performance enhancements for cryptography [jsc#PED-512]
  * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch
  * openssl-1_1-Fixed-counter-overflow.patch
  * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch
  * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch
  * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">- FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685534400">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1686744000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Reworked the Fix for the Timing Oracle in RSA Decryption
    The previous fix for this timing side channel turned out to cause
    a severe 2-3x performance regression in the typical use case
    compared to 1.1.1s.
  * Add openssl-CVE-2022-4304.patch
  * Removed patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch
  * Refreshed patches:
  - openssl-CVE-2023-0464.patch
  - openssl-CVE-2023-0465.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1689854400">- Security fix: [bsc#1213487, CVE-2023-3446]
  * Fix DH_check() excessive time with over sized modulus.
  * The function DH_check() performs various checks on DH parameters.
    One of those checks confirms that the modulus ("p" parameter) is
    not too large. Trying to use a very large modulus is slow and
    OpenSSL will not normally use a modulus which is over 10,000 bits
    in length.
    However the DH_check() function checks numerous aspects of the
    key or parameters that have been supplied. Some of those checks
    use the supplied modulus value even if it has already been found
    to be too large.
    A new limit has been added to DH_check of 32,768 bits. Supplying
    a key/parameters with a modulus over this size will simply cause
    DH_check() to fail.
  * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1690200000">- Dont pass zero length input to EVP_Cipher because assembler
  optimized AES cannot handle zero size. [bsc#1213517]
  * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1690891200">- Security fix: (bsc#1213853, CVE-2023-3817)
  * Fix excessive time spent checking DH q parameter value
    (bsc#1213853, CVE-2023-3817). The function DH_check() performs
    various checks on DH parameters. After fixing CVE-2023-3446 it
    was discovered that a large q parameter value can also trigger
    an overly long computation during some of these checks. A
    correct q value, if present, cannot be larger than the modulus
    p parameter, thus it is unnecessary to perform these checks if
    q is larger than p. If DH_check() is called with such q parameter
    value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
    computationally intensive checks are skipped.
  * Add openssl-1_1-CVE-2023-3817.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696420800">- Displays "fips" in the version string (bsc#1215215)
  * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch</changelog>
</package>
<package pkgid="a71cf6cb9b91442ae5dc138421db7a3543a922dccbb02a8978b06e9fb8a451cb" name="openssl-1_1" arch="src">
  <version epoch="0" ver="1.1.1l" rel="150500.17.19.1"/>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1669982400">- POWER10 performance enhancements for cryptography [jsc#PED-512]
  * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch
  * openssl-1_1-Fixed-counter-overflow.patch
  * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch
  * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch
  * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">- FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685534400">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1686744000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Reworked the Fix for the Timing Oracle in RSA Decryption
    The previous fix for this timing side channel turned out to cause
    a severe 2-3x performance regression in the typical use case
    compared to 1.1.1s.
  * Add openssl-CVE-2022-4304.patch
  * Removed patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch
  * Refreshed patches:
  - openssl-CVE-2023-0464.patch
  - openssl-CVE-2023-0465.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1689854400">- Security fix: [bsc#1213487, CVE-2023-3446]
  * Fix DH_check() excessive time with over sized modulus.
  * The function DH_check() performs various checks on DH parameters.
    One of those checks confirms that the modulus ("p" parameter) is
    not too large. Trying to use a very large modulus is slow and
    OpenSSL will not normally use a modulus which is over 10,000 bits
    in length.
    However the DH_check() function checks numerous aspects of the
    key or parameters that have been supplied. Some of those checks
    use the supplied modulus value even if it has already been found
    to be too large.
    A new limit has been added to DH_check of 32,768 bits. Supplying
    a key/parameters with a modulus over this size will simply cause
    DH_check() to fail.
  * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1690200000">- Dont pass zero length input to EVP_Cipher because assembler
  optimized AES cannot handle zero size. [bsc#1213517]
  * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1690891200">- Security fix: (bsc#1213853, CVE-2023-3817)
  * Fix excessive time spent checking DH q parameter value
    (bsc#1213853, CVE-2023-3817). The function DH_check() performs
    various checks on DH parameters. After fixing CVE-2023-3446 it
    was discovered that a large q parameter value can also trigger
    an overly long computation during some of these checks. A
    correct q value, if present, cannot be larger than the modulus
    p parameter, thus it is unnecessary to perform these checks if
    q is larger than p. If DH_check() is called with such q parameter
    value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
    computationally intensive checks are skipped.
  * Add openssl-1_1-CVE-2023-3817.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696420800">- Displays "fips" in the version string (bsc#1215215)
  * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch</changelog>
</package>
<package pkgid="0278e98c4f9029345ff0e764315524f3ddc993e30ec6f1c59db6958d66a614dc" name="openssl-1_1" arch="x86_64">
  <version epoch="0" ver="1.1.1l" rel="150500.17.19.1"/>
  <changelog author="pmonreal@suse.com" date="1666958400">- FIPS: Add a missing dependency on jitterentropy-devel for
  libopenssl-1_1-devel [bsc#1202148]</changelog>
  <changelog author="pmonreal@suse.com" date="1668600000">- FIPS: Service-level indicator [bsc#1190651]
  * Return the correct indicator for a given EC group order bits
  * Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1668600001">- FIPS: Service-level indicator [bsc#1190651]
  * Consider RSA siggen/sigver with PKCS1 padding also approved
  * Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1669032000">- FIPS: Service-level indicator [bsc#1190651]
  * Mark PBKDF2 with key shorter than 112 bits as non-approved
  * Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1669982400">- POWER10 performance enhancements for cryptography [jsc#PED-512]
  * openssl-1_1-AES-GCM-performance-optimzation-with-stitched-method.patch
  * openssl-1_1-Fixed-counter-overflow.patch
  * openssl-1_1-chacha20-performance-optimizations-for-ppc64le-with-.patch
  * openssl-1_1-Fixed-conditional-statement-testing-64-and-256-bytes.patch
  * openssl-1_1-Fix-AES-GCM-on-Power-8-CPUs.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Timing Oracle in RSA Decryption
  * Add patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648001">- Security Fix: [bsc#1207538, CVE-2022-4450]
  * Double free after calling PEM_read_bio_ex()
  * Add patches:
  - openssl-CVE-2022-4450-1of2.patch
  - openssl-CVE-2022-4450-2of2.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648002">- Security Fix: [bsc#1207536, CVE-2023-0215]
  * Use-after-free following BIO_new_NDEF()
  * Add patches:
  - openssl-CVE-2023-0215-1of4.patch
  - openssl-CVE-2023-0215-2of4.patch
  - openssl-CVE-2023-0215-3of4.patch
  - openssl-CVE-2023-0215-4of4.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1674648003">- Security Fix: [bsc#1207533, CVE-2023-0286]
  * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
    for x400Address
  * Add openssl-CVE-2023-0286.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1675857600">- FIPS: Serialize jitterentropy calls [bsc#1207994]
  * Add openssl-1_1-serialize-jitterentropy-calls.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1678190400">- FIPS: Service-level indicator [bsc#1208998]
  * Add additional check required by FIPS 140-3. Minimum values for
    PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
    iteration count and 20 characters for password.
  * Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1679659200">- Security Fix: [CVE-2023-0464, bsc#1209624]
  * Excessive Resource Usage Verifying X.509 Policy Constraints
  * Add openssl-CVE-2023-0464.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1680523200">- Security Fix: [CVE-2023-0465, bsc#1209878]
  * Invalid certificate policies in leaf certificates are silently ignored
  * Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
  * Certificate policy check not enabled
  * Add openssl-CVE-2023-0466.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1684756800">- Security Fix: [CVE-2023-2650, bsc#1211430]
  * Possible DoS translating ASN.1 object identifiers
  * Add openssl-CVE-2023-2650.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1685534400">- Update further expiring certificates that affect tests [bsc#1201627]
  * Add openssl-Update-further-expiring-certificates.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1686744000">- Security Fix: [bsc#1207534, CVE-2022-4304]
  * Reworked the Fix for the Timing Oracle in RSA Decryption
    The previous fix for this timing side channel turned out to cause
    a severe 2-3x performance regression in the typical use case
    compared to 1.1.1s.
  * Add openssl-CVE-2022-4304.patch
  * Removed patches:
  - openssl-CVE-2022-4304-1of2.patch
  - openssl-CVE-2022-4304-2of2.patch
  * Refreshed patches:
  - openssl-CVE-2023-0464.patch
  - openssl-CVE-2023-0465.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1689854400">- Security fix: [bsc#1213487, CVE-2023-3446]
  * Fix DH_check() excessive time with over sized modulus.
  * The function DH_check() performs various checks on DH parameters.
    One of those checks confirms that the modulus ("p" parameter) is
    not too large. Trying to use a very large modulus is slow and
    OpenSSL will not normally use a modulus which is over 10,000 bits
    in length.
    However the DH_check() function checks numerous aspects of the
    key or parameters that have been supplied. Some of those checks
    use the supplied modulus value even if it has already been found
    to be too large.
    A new limit has been added to DH_check of 32,768 bits. Supplying
    a key/parameters with a modulus over this size will simply cause
    DH_check() to fail.
  * Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1690200000">- Dont pass zero length input to EVP_Cipher because assembler
  optimized AES cannot handle zero size. [bsc#1213517]
  * Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1690891200">- Security fix: (bsc#1213853, CVE-2023-3817)
  * Fix excessive time spent checking DH q parameter value
    (bsc#1213853, CVE-2023-3817). The function DH_check() performs
    various checks on DH parameters. After fixing CVE-2023-3446 it
    was discovered that a large q parameter value can also trigger
    an overly long computation during some of these checks. A
    correct q value, if present, cannot be larger than the modulus
    p parameter, thus it is unnecessary to perform these checks if
    q is larger than p. If DH_check() is called with such q parameter
    value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
    computationally intensive checks are skipped.
  * Add openssl-1_1-CVE-2023-3817.patch</changelog>
  <changelog author="otto.hollmann@suse.com" date="1696420800">- Displays "fips" in the version string (bsc#1215215)
  * Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch</changelog>
</package>
<package pkgid="9ea8380bfb32d632d4d36d859546e789117a3665ecc4c926a78746e4c07c541c" name="pam_apparmor" arch="aarch64">
  <version epoch="0" ver="3.0.4" rel="150500.11.9.1"/>
  <changelog author="suse-beta@cboltz.de" date="1634299200">- add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1636459200">- add aa-notify-more-arch-mr809.diff: Add support for reading s390x
  and aarch64 wtmp files (boo#1181155)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1639915200">- add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and
  /etc/ssl/engines.d/ in abstractions/openssl which were introduced
  with the latest openssl update</changelog>
  <changelog author="nopower@suse.com" date="1640001600">-  Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED
  operation="file_mmap" violation in SLE15-SP4; (bsc#1192336).</changelog>
  <changelog author="scabrero@suse.de" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb (bsc#1192684).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1643198400">- add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221,
  MR 827)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1644494400">- update to AppArmor 3.0.4
  - various fixes in profiles, abstractions, apparmor_parser and utils
    (some of them were already included as patches)
  - add support for mctp address family
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4
    for the full upstream changelog
- remove upstream(ed) patches:
  - aa-notify-more-arch-mr809.diff
  - ruby-3.1-build-fix.diff
  - add-samba-bgqd.diff
  - openssl-engdef-mr818.diff
  - profiles-python-3.10-mr783.diff
  - update-samba-abstractions-ldb2.diff
- refresh patches:
  - apparmor-samba-include-permissions-for-shares.diff
  - ruby-2_0-mkmf-destdir.patch</changelog>
  <changelog author="nopower@suse.com" date="1648123200">- Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1648555200">- ensure precompiled cache files are newer than (text) profiles
- reload profiles in %posttrans instead of %post to ensure both
  - profiles and -abstractons package are updated before the cache
  in /var/cache/apparmor/ gets built (boo#1195463 #c20)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1649592000">- add profile for zgrep and xzgrep to prevent CVE-2022-1271
  (zgrep-profile-mr870.diff)</changelog>
  <changelog author="nopower@suse.com" date="1649678400">- Add samba_deny_net_admin.patch to add new rule to deny
  noisy setsockopt calls from systemd; (bnc#1196850).</changelog>
  <changelog author="nopower@suse.com" date="1649851200">- Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon
  which now will spawn new additional services on demand. We need to
  modify the existing smbd/winbind profiles and additionally add a
  new set of profiles to cater for the new functionality;
  (bnc#1198309);</changelog>
  <changelog author="suse-beta@cboltz.de" date="1650110400">- update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531)</changelog>
  <changelog author="dimstar@opensuse.org" date="1651060800">- Enhance zgrep-profile-mr870.diff to also allow/support zstd
  (boo#1198922).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1651233600">- add php8-fpm-mr876.patch so that php8 php-fpm can read its config
  (boo#1186267#c11)
- parser: add conflict with apparmor-utils &lt; 3.0 to avoid aa-status
  file conflict on upgrade (boo#1198958)
- utils: add missing dependency on apparmor-parser (boo#1198958#c4)</changelog>
  <changelog author="ddiss@suse.com" date="1661515200">- add profiles-permit-php-fpm-pid-files-directly-under-run.patch
  https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344)</changelog>
  <changelog author="scabrero@suse.de" date="1671796800">- Add samba-4-17.patch to update the samba profiles for samba
  version 4.17 (bsc#1206626);</changelog>
  <changelog author="ddiss@suse.com" date="1690286400">- Add pam_apparmor README, referenced from online cha-apparmor-pam.html
  documentation (bsc#1213472)</changelog>
  <changelog author="ddiss@suse.com" date="1693915200">- update zgrep profile to allow egrep helper use (bsc#1214458)
  - zgrep-profile-sync-with-master.diff</changelog>
  <changelog author="ddiss@suse.com" date="1695643200">- Fix pam_apparmor %post and %postun scripts to handle pam-config errors
  (bsc#1215596)</changelog>
</package>
<package pkgid="0161be2da89bdf0ed67c70a42f4da15e1c47b680c81303d63546417f8ac8e7b9" name="pam_apparmor" arch="s390x">
  <version epoch="0" ver="3.0.4" rel="150500.11.9.1"/>
  <changelog author="suse-beta@cboltz.de" date="1634299200">- add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1636459200">- add aa-notify-more-arch-mr809.diff: Add support for reading s390x
  and aarch64 wtmp files (boo#1181155)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1639915200">- add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and
  /etc/ssl/engines.d/ in abstractions/openssl which were introduced
  with the latest openssl update</changelog>
  <changelog author="nopower@suse.com" date="1640001600">-  Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED
  operation="file_mmap" violation in SLE15-SP4; (bsc#1192336).</changelog>
  <changelog author="scabrero@suse.de" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb (bsc#1192684).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1643198400">- add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221,
  MR 827)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1644494400">- update to AppArmor 3.0.4
  - various fixes in profiles, abstractions, apparmor_parser and utils
    (some of them were already included as patches)
  - add support for mctp address family
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4
    for the full upstream changelog
- remove upstream(ed) patches:
  - aa-notify-more-arch-mr809.diff
  - ruby-3.1-build-fix.diff
  - add-samba-bgqd.diff
  - openssl-engdef-mr818.diff
  - profiles-python-3.10-mr783.diff
  - update-samba-abstractions-ldb2.diff
- refresh patches:
  - apparmor-samba-include-permissions-for-shares.diff
  - ruby-2_0-mkmf-destdir.patch</changelog>
  <changelog author="nopower@suse.com" date="1648123200">- Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1648555200">- ensure precompiled cache files are newer than (text) profiles
- reload profiles in %posttrans instead of %post to ensure both
  - profiles and -abstractons package are updated before the cache
  in /var/cache/apparmor/ gets built (boo#1195463 #c20)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1649592000">- add profile for zgrep and xzgrep to prevent CVE-2022-1271
  (zgrep-profile-mr870.diff)</changelog>
  <changelog author="nopower@suse.com" date="1649678400">- Add samba_deny_net_admin.patch to add new rule to deny
  noisy setsockopt calls from systemd; (bnc#1196850).</changelog>
  <changelog author="nopower@suse.com" date="1649851200">- Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon
  which now will spawn new additional services on demand. We need to
  modify the existing smbd/winbind profiles and additionally add a
  new set of profiles to cater for the new functionality;
  (bnc#1198309);</changelog>
  <changelog author="suse-beta@cboltz.de" date="1650110400">- update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531)</changelog>
  <changelog author="dimstar@opensuse.org" date="1651060800">- Enhance zgrep-profile-mr870.diff to also allow/support zstd
  (boo#1198922).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1651233600">- add php8-fpm-mr876.patch so that php8 php-fpm can read its config
  (boo#1186267#c11)
- parser: add conflict with apparmor-utils &lt; 3.0 to avoid aa-status
  file conflict on upgrade (boo#1198958)
- utils: add missing dependency on apparmor-parser (boo#1198958#c4)</changelog>
  <changelog author="ddiss@suse.com" date="1661515200">- add profiles-permit-php-fpm-pid-files-directly-under-run.patch
  https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344)</changelog>
  <changelog author="scabrero@suse.de" date="1671796800">- Add samba-4-17.patch to update the samba profiles for samba
  version 4.17 (bsc#1206626);</changelog>
  <changelog author="ddiss@suse.com" date="1690286400">- Add pam_apparmor README, referenced from online cha-apparmor-pam.html
  documentation (bsc#1213472)</changelog>
  <changelog author="ddiss@suse.com" date="1693915200">- update zgrep profile to allow egrep helper use (bsc#1214458)
  - zgrep-profile-sync-with-master.diff</changelog>
  <changelog author="ddiss@suse.com" date="1695643200">- Fix pam_apparmor %post and %postun scripts to handle pam-config errors
  (bsc#1215596)</changelog>
</package>
<package pkgid="4906e4cbf5e3540650daadc511704014183422af0d4817fbc678643cbb302491" name="pam_apparmor" arch="x86_64">
  <version epoch="0" ver="3.0.4" rel="150500.11.9.1"/>
  <changelog author="suse-beta@cboltz.de" date="1634299200">- add add-samba-bgqd.diff: add profile for samba-bgqd (boo#1191532)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1636459200">- add aa-notify-more-arch-mr809.diff: Add support for reading s390x
  and aarch64 wtmp files (boo#1181155)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1639915200">- add openssl-engdef-mr818.diff: Allow reading /etc/ssl/engdef.d/ and
  /etc/ssl/engines.d/ in abstractions/openssl which were introduced
  with the latest openssl update</changelog>
  <changelog author="nopower@suse.com" date="1640001600">-  Modify add-samba-bgqd.diff: Add new rule to fix new "DENIED
  operation="file_mmap" violation in SLE15-SP4; (bsc#1192336).</changelog>
  <changelog author="scabrero@suse.de" date="1642420800">- add update-samba-abstractions-ldb2.diff: Cater for changes to ldb
  packaging to allow parallel installation with libldb (bsc#1192684).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1643198400">- add ruby-3.1-build-fix.diff: fix build with ruby 3.1 (boo#1194221,
  MR 827)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1644494400">- update to AppArmor 3.0.4
  - various fixes in profiles, abstractions, apparmor_parser and utils
    (some of them were already included as patches)
  - add support for mctp address family
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.4
    for the full upstream changelog
- remove upstream(ed) patches:
  - aa-notify-more-arch-mr809.diff
  - ruby-3.1-build-fix.diff
  - add-samba-bgqd.diff
  - openssl-engdef-mr818.diff
  - profiles-python-3.10-mr783.diff
  - update-samba-abstractions-ldb2.diff
- refresh patches:
  - apparmor-samba-include-permissions-for-shares.diff
  - ruby-2_0-mkmf-destdir.patch</changelog>
  <changelog author="nopower@suse.com" date="1648123200">- Add update-samba-bgqd.diff to add new rule to fix 'DENIED' open on
  /proc/{pid}/fd for samba-bgqd (bnc#1196850).
- Add update-usr-sbin-smbd.diff to add new rule to allow reading of
  openssl.cnf (bnc#1195463).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1648555200">- ensure precompiled cache files are newer than (text) profiles
- reload profiles in %posttrans instead of %post to ensure both
  - profiles and -abstractons package are updated before the cache
  in /var/cache/apparmor/ gets built (boo#1195463 #c20)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1649592000">- add profile for zgrep and xzgrep to prevent CVE-2022-1271
  (zgrep-profile-mr870.diff)</changelog>
  <changelog author="nopower@suse.com" date="1649678400">- Add samba_deny_net_admin.patch to add new rule to deny
  noisy setsockopt calls from systemd; (bnc#1196850).</changelog>
  <changelog author="nopower@suse.com" date="1649851200">- Add samba-new-dcerpcd.patch, samba-4.16 has a new dcerpcd daemon
  which now will spawn new additional services on demand. We need to
  modify the existing smbd/winbind profiles and additionally add a
  new set of profiles to cater for the new functionality;
  (bnc#1198309);</changelog>
  <changelog author="suse-beta@cboltz.de" date="1650110400">- update zgrep-profile-mr870.diff to allow executing 'expr' (boo#1198531)</changelog>
  <changelog author="dimstar@opensuse.org" date="1651060800">- Enhance zgrep-profile-mr870.diff to also allow/support zstd
  (boo#1198922).</changelog>
  <changelog author="suse-beta@cboltz.de" date="1651233600">- add php8-fpm-mr876.patch so that php8 php-fpm can read its config
  (boo#1186267#c11)
- parser: add conflict with apparmor-utils &lt; 3.0 to avoid aa-status
  file conflict on upgrade (boo#1198958)
- utils: add missing dependency on apparmor-parser (boo#1198958#c4)</changelog>
  <changelog author="ddiss@suse.com" date="1661515200">- add profiles-permit-php-fpm-pid-files-directly-under-run.patch
  https://gitlab.com/apparmor/apparmor/-/merge_requests/914 (bsc#1202344)</changelog>
  <changelog author="scabrero@suse.de" date="1671796800">- Add samba-4-17.patch to update the samba profiles for samba
  version 4.17 (bsc#1206626);</changelog>
  <changelog author="ddiss@suse.com" date="1690286400">- Add pam_apparmor README, referenced from online cha-apparmor-pam.html
  documentation (bsc#1213472)</changelog>
  <changelog author="ddiss@suse.com" date="1693915200">- update zgrep profile to allow egrep helper use (bsc#1214458)
  - zgrep-profile-sync-with-master.diff</changelog>
  <changelog author="ddiss@suse.com" date="1695643200">- Fix pam_apparmor %post and %postun scripts to handle pam-config errors
  (bsc#1215596)</changelog>
</package>
<package pkgid="5490df4cc18bcd2dd6a8a486666dc34261a3b8e25d2e54259a0cfec17a8e2e4f" name="pciutils" arch="aarch64">
  <version epoch="0" ver="3.5.6" rel="150300.13.6.1"/>
  <changelog author="tchvatal@suse.com" date="1416312000">- Version bump to 3.3.0:
  * Device names exported by BIOS are displayed on Linux.
  * On Linux systems, HWDB is used to look up device names
    when our ID database gives no match. (More precisely,
    HWDB is consulted after local pci.ids, but before using
    network to query online pci.ids.) Thanks to Tom Gundersen
    for the initial patch.
  * Added experimental back-end for OS X / Darwin. Thanks to
    Richard Yao for providing it.
  * Filters now support matching by device class. Original
    patch by Matthew Wilcox, wrappers for ABI compatibility
    by me.
  * Interrupt Pin and Interrupt Line registers are displayed
    for bridge devices, too.
  * Several portability bugs have been fixed.
  * Several typos have been fixed. Also, use of questionable
    constructs in man pages has been reduced.
  * PCIe link capabilities now include the ASPMOptComp bit.
  * The "CRS Software Visibility" bit is now decoded properly.
  * Updated pci.ids to the current snapshot of the database.
- Refresh patch:
  * pciutils-endianh.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1441540800">- Update to 3.3.1
  * Removed hacks for backward compatibility with Linux libc5,
    which were breaking newer non-glibc Linux systems. Thanks
    to Felix Janda.
  * Display VirtIO vendor-specific capability. Patch by Gerd
    Hoffmann.
  * Fixed memory leak in name cache.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="mpluskal@suse.com" date="1447416000">- Update to 3.4.0
  * On Linux, we report NUMA nodes of devices.
  * The sysfs back-end does not die on read errors
    of optional attributes. Instead, a warning is produced.
  * Fixed several minor bugs.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="jengelh@inai.de" date="1448107200">- Summary update</changelog>
  <changelog author="tchvatal@suse.com" date="1452254400">- Version update to 3.4.1:
  * New capabilities decoded: Process Address Space, Page Request
    Interface, Enhanced Allocation. Thanks to David Daney and
    David Woodhouse.
  * DevCap SlotPowerLimit is now decoded for all components with
    upstream ports.</changelog>
  <changelog author="mpluskal@suse.com" date="1463745600">- Update to version 3.5.0:
  * New capabilities decoded: Downstream Port Containment,
    Precision Time Measurement. Thanks to Keith Busch and
    Jonathan Yong.
  * Domain numbers extended to 31 bits. This will be used by the
    Linux kernel on some machines in near future.
  * Enhanced allocation regions are now decoded on Linux.
  * The NetBSD back-end supports PCIe extended configuration space.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="mpluskal@suse.com" date="1464177600">- Update to version 3.5.1:
  * Fixed symbol versioning of pci_init().</changelog>
  <changelog author="mpluskal@suse.com" date="1488196800">- Update to version 3.5.4:
  * Previous version broke compilation on systems, for which
    lib/types.h did not provide a 64-bit integer type. It is
    provided everywhere now.
- Changes for version 3.5.3:
  * When lspci looks for Linux kernel modules, it uses the default
  path to module directory provided by libkmod. Previously,
  it tried to construct the path explicitly, which need not
  work on all systems.
  * Improved formatting of memory and I/O ranges behind a bridge.
  * PCIe link capabilities now display GEN4 speed (16GT/s).
  * PCIe device capabilities now show bits related to atomic
    operations.
- Changes for version 3.5.2:
  * The L1 power management capability is now decoded more
  thoroughly. Thanks to Rajat Jain for the patch.
  * The table of configuration registers used by setpci
  had a bug in the definition of SUBSYSTEM_VENDOR_ID.</changelog>
  <changelog author="aavindraa@gmail.com" date="1510401600">- Update to version 3.5.5
  * Better decoding of AER capability.
  * "Slot Implemented" flag is decoded for PCI/PCI-X to PCIe bridges.
  * Minor fixes of decoding other capabilities.
  * As usual, updated pci.ids to the current snapshot of the
    database.
- cleanup with spec-cleaner
- switch from ftp to https
- track signature</changelog>
  <changelog author="aavindraa@gmail.com" date="1511092800">- Update to version 3.5.6
  * MN VPD keyword is decoded correctly.
  * As usual, updated pci.ids to the current snapshot of the
    database.
  * FreeBSD back-end: read-only access for non-root, support
    DragonFly BSD, support extended config space.</changelog>
  <changelog author="msuchanek@suse.com" date="1590062400">- Fix lspci outputs few of the VPD data fields are displayed as unknown (bsc#1170554, ltc#185587).
  Added:
  * pciutils-VPD-When-printing-item-IDs-escape-non-ASCII-characte.patch
  * pciutils-VPD-Cleanup.patch
  * pciutils-Add-decoding-of-vendor-specific-VPD-fields.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603972800">- Add decode support for RCECs [jsc#SLE-13735]
- added patches
  https://github.com/pciutils/pciutils/commit/e12bd01eea67ca8cf539263124843ba281eb6ecc
  + pciutils-add-decode-support-for-RCECs.patch</changelog>
  <changelog author="vliaskovitis@suse.com" date="1643025600">- Add pciutils-Add-PCIe-5.0-data-rate-32-GT-s-support.patch
  Add pciutils-Add-PCIe-6.0-data-rate-64-GT-s-support.patch
  (bsc#1192862)</changelog>
  <changelog author="psimons@suse.com" date="1696420800">- Apply "lspci-Fixed-buffer-overflows-in-ls-tree.c.patch" to fix a
  buffer overflow error that would cause lspci to crash on systems
  with complex topologies. [bsc#1215265]
- Add "pciutils.keyring" so that the tarball's signature can be
  verified at build time.
- Use "%license" tag instead of "%doc" to install the package's
  license file.</changelog>
</package>
<package pkgid="9f79d397feeab25ba1ed2d5199d83760ac930d375656d95374f3b8ef48311ce8" name="pciutils" arch="s390x">
  <version epoch="0" ver="3.5.6" rel="150300.13.6.1"/>
  <changelog author="tchvatal@suse.com" date="1416312000">- Version bump to 3.3.0:
  * Device names exported by BIOS are displayed on Linux.
  * On Linux systems, HWDB is used to look up device names
    when our ID database gives no match. (More precisely,
    HWDB is consulted after local pci.ids, but before using
    network to query online pci.ids.) Thanks to Tom Gundersen
    for the initial patch.
  * Added experimental back-end for OS X / Darwin. Thanks to
    Richard Yao for providing it.
  * Filters now support matching by device class. Original
    patch by Matthew Wilcox, wrappers for ABI compatibility
    by me.
  * Interrupt Pin and Interrupt Line registers are displayed
    for bridge devices, too.
  * Several portability bugs have been fixed.
  * Several typos have been fixed. Also, use of questionable
    constructs in man pages has been reduced.
  * PCIe link capabilities now include the ASPMOptComp bit.
  * The "CRS Software Visibility" bit is now decoded properly.
  * Updated pci.ids to the current snapshot of the database.
- Refresh patch:
  * pciutils-endianh.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1441540800">- Update to 3.3.1
  * Removed hacks for backward compatibility with Linux libc5,
    which were breaking newer non-glibc Linux systems. Thanks
    to Felix Janda.
  * Display VirtIO vendor-specific capability. Patch by Gerd
    Hoffmann.
  * Fixed memory leak in name cache.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="mpluskal@suse.com" date="1447416000">- Update to 3.4.0
  * On Linux, we report NUMA nodes of devices.
  * The sysfs back-end does not die on read errors
    of optional attributes. Instead, a warning is produced.
  * Fixed several minor bugs.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="jengelh@inai.de" date="1448107200">- Summary update</changelog>
  <changelog author="tchvatal@suse.com" date="1452254400">- Version update to 3.4.1:
  * New capabilities decoded: Process Address Space, Page Request
    Interface, Enhanced Allocation. Thanks to David Daney and
    David Woodhouse.
  * DevCap SlotPowerLimit is now decoded for all components with
    upstream ports.</changelog>
  <changelog author="mpluskal@suse.com" date="1463745600">- Update to version 3.5.0:
  * New capabilities decoded: Downstream Port Containment,
    Precision Time Measurement. Thanks to Keith Busch and
    Jonathan Yong.
  * Domain numbers extended to 31 bits. This will be used by the
    Linux kernel on some machines in near future.
  * Enhanced allocation regions are now decoded on Linux.
  * The NetBSD back-end supports PCIe extended configuration space.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="mpluskal@suse.com" date="1464177600">- Update to version 3.5.1:
  * Fixed symbol versioning of pci_init().</changelog>
  <changelog author="mpluskal@suse.com" date="1488196800">- Update to version 3.5.4:
  * Previous version broke compilation on systems, for which
    lib/types.h did not provide a 64-bit integer type. It is
    provided everywhere now.
- Changes for version 3.5.3:
  * When lspci looks for Linux kernel modules, it uses the default
  path to module directory provided by libkmod. Previously,
  it tried to construct the path explicitly, which need not
  work on all systems.
  * Improved formatting of memory and I/O ranges behind a bridge.
  * PCIe link capabilities now display GEN4 speed (16GT/s).
  * PCIe device capabilities now show bits related to atomic
    operations.
- Changes for version 3.5.2:
  * The L1 power management capability is now decoded more
  thoroughly. Thanks to Rajat Jain for the patch.
  * The table of configuration registers used by setpci
  had a bug in the definition of SUBSYSTEM_VENDOR_ID.</changelog>
  <changelog author="aavindraa@gmail.com" date="1510401600">- Update to version 3.5.5
  * Better decoding of AER capability.
  * "Slot Implemented" flag is decoded for PCI/PCI-X to PCIe bridges.
  * Minor fixes of decoding other capabilities.
  * As usual, updated pci.ids to the current snapshot of the
    database.
- cleanup with spec-cleaner
- switch from ftp to https
- track signature</changelog>
  <changelog author="aavindraa@gmail.com" date="1511092800">- Update to version 3.5.6
  * MN VPD keyword is decoded correctly.
  * As usual, updated pci.ids to the current snapshot of the
    database.
  * FreeBSD back-end: read-only access for non-root, support
    DragonFly BSD, support extended config space.</changelog>
  <changelog author="msuchanek@suse.com" date="1590062400">- Fix lspci outputs few of the VPD data fields are displayed as unknown (bsc#1170554, ltc#185587).
  Added:
  * pciutils-VPD-When-printing-item-IDs-escape-non-ASCII-characte.patch
  * pciutils-VPD-Cleanup.patch
  * pciutils-Add-decoding-of-vendor-specific-VPD-fields.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603972800">- Add decode support for RCECs [jsc#SLE-13735]
- added patches
  https://github.com/pciutils/pciutils/commit/e12bd01eea67ca8cf539263124843ba281eb6ecc
  + pciutils-add-decode-support-for-RCECs.patch</changelog>
  <changelog author="vliaskovitis@suse.com" date="1643025600">- Add pciutils-Add-PCIe-5.0-data-rate-32-GT-s-support.patch
  Add pciutils-Add-PCIe-6.0-data-rate-64-GT-s-support.patch
  (bsc#1192862)</changelog>
  <changelog author="psimons@suse.com" date="1696420800">- Apply "lspci-Fixed-buffer-overflows-in-ls-tree.c.patch" to fix a
  buffer overflow error that would cause lspci to crash on systems
  with complex topologies. [bsc#1215265]
- Add "pciutils.keyring" so that the tarball's signature can be
  verified at build time.
- Use "%license" tag instead of "%doc" to install the package's
  license file.</changelog>
</package>
<package pkgid="18c209170cbc8fabc55e9a50fd36aff3385e72d9820342f9127fdc2612505890" name="pciutils" arch="src">
  <version epoch="0" ver="3.5.6" rel="150300.13.6.1"/>
  <changelog author="jengelh@medozas.de" date="1332072000">- Shared library policy: new subpackage libpci3</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1356955200">- pciutils-endianh.patch Use the documented/optimized byteswapping
  routines from endian.h</changelog>
  <changelog author="idonmez@suse.com" date="1366027200">- Add Source URL, see https://en.opensuse.org/SourceUrls</changelog>
  <changelog author="sweet_f_a@gmx.de" date="1375185600">- Update to 3.2.0
  * On newer Linux systems, we use libkmod to look up kernel
    modules (modules.pcimap no longer exists.) To facilitate this,
    libpci is able to look up module aliases in sysfs.
  * Various minor bug fixes.
  * Updated pci.ids to the today's snapshot of the database.
- Update to 3.1.10
  * Decoding of LTR/OBFF in PCIe capabilities.
  * Various minor bug fixes.
  * Updated pci.ids to the today's snapshot of the database.
- rebase patches
- require libkmod</changelog>
  <changelog author="tchvatal@suse.com" date="1399982400">- Remove COPYING from obs it is in tarball directly
- Version bump to 3.2.1:
  * CardBus bridge capabilities are displayed.
  * PCIe L1 PM substates are decoded.
  * Various bugs were fixed in decoding of PCIe capabilities.
  * The sysfs back-end does not spit out unnecessary warnings when
    empty slots report only a partial device address. This actually
    happens on IBM pSeries.
  * Updated pci.ids to the today's snapshot of the database.
- Cleanup with spec-cleaner</changelog>
  <changelog author="fcrozat@suse.com" date="1408363200">- Add obsoletes/provides to baselibs.conf.</changelog>
  <changelog author="tchvatal@suse.com" date="1416312000">- Version bump to 3.3.0:
  * Device names exported by BIOS are displayed on Linux.
  * On Linux systems, HWDB is used to look up device names
    when our ID database gives no match. (More precisely,
    HWDB is consulted after local pci.ids, but before using
    network to query online pci.ids.) Thanks to Tom Gundersen
    for the initial patch.
  * Added experimental back-end for OS X / Darwin. Thanks to
    Richard Yao for providing it.
  * Filters now support matching by device class. Original
    patch by Matthew Wilcox, wrappers for ABI compatibility
    by me.
  * Interrupt Pin and Interrupt Line registers are displayed
    for bridge devices, too.
  * Several portability bugs have been fixed.
  * Several typos have been fixed. Also, use of questionable
    constructs in man pages has been reduced.
  * PCIe link capabilities now include the ASPMOptComp bit.
  * The "CRS Software Visibility" bit is now decoded properly.
  * Updated pci.ids to the current snapshot of the database.
- Refresh patch:
  * pciutils-endianh.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1441540800">- Update to 3.3.1
  * Removed hacks for backward compatibility with Linux libc5,
    which were breaking newer non-glibc Linux systems. Thanks
    to Felix Janda.
  * Display VirtIO vendor-specific capability. Patch by Gerd
    Hoffmann.
  * Fixed memory leak in name cache.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="mpluskal@suse.com" date="1447416000">- Update to 3.4.0
  * On Linux, we report NUMA nodes of devices.
  * The sysfs back-end does not die on read errors
    of optional attributes. Instead, a warning is produced.
  * Fixed several minor bugs.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="jengelh@inai.de" date="1448107200">- Summary update</changelog>
  <changelog author="tchvatal@suse.com" date="1452254400">- Version update to 3.4.1:
  * New capabilities decoded: Process Address Space, Page Request
    Interface, Enhanced Allocation. Thanks to David Daney and
    David Woodhouse.
  * DevCap SlotPowerLimit is now decoded for all components with
    upstream ports.</changelog>
  <changelog author="mpluskal@suse.com" date="1463745600">- Update to version 3.5.0:
  * New capabilities decoded: Downstream Port Containment,
    Precision Time Measurement. Thanks to Keith Busch and
    Jonathan Yong.
  * Domain numbers extended to 31 bits. This will be used by the
    Linux kernel on some machines in near future.
  * Enhanced allocation regions are now decoded on Linux.
  * The NetBSD back-end supports PCIe extended configuration space.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="mpluskal@suse.com" date="1464177600">- Update to version 3.5.1:
  * Fixed symbol versioning of pci_init().</changelog>
  <changelog author="mpluskal@suse.com" date="1488196800">- Update to version 3.5.4:
  * Previous version broke compilation on systems, for which
    lib/types.h did not provide a 64-bit integer type. It is
    provided everywhere now.
- Changes for version 3.5.3:
  * When lspci looks for Linux kernel modules, it uses the default
  path to module directory provided by libkmod. Previously,
  it tried to construct the path explicitly, which need not
  work on all systems.
  * Improved formatting of memory and I/O ranges behind a bridge.
  * PCIe link capabilities now display GEN4 speed (16GT/s).
  * PCIe device capabilities now show bits related to atomic
    operations.
- Changes for version 3.5.2:
  * The L1 power management capability is now decoded more
  thoroughly. Thanks to Rajat Jain for the patch.
  * The table of configuration registers used by setpci
  had a bug in the definition of SUBSYSTEM_VENDOR_ID.</changelog>
  <changelog author="aavindraa@gmail.com" date="1510401600">- Update to version 3.5.5
  * Better decoding of AER capability.
  * "Slot Implemented" flag is decoded for PCI/PCI-X to PCIe bridges.
  * Minor fixes of decoding other capabilities.
  * As usual, updated pci.ids to the current snapshot of the
    database.
- cleanup with spec-cleaner
- switch from ftp to https
- track signature</changelog>
  <changelog author="aavindraa@gmail.com" date="1511092800">- Update to version 3.5.6
  * MN VPD keyword is decoded correctly.
  * As usual, updated pci.ids to the current snapshot of the
    database.
  * FreeBSD back-end: read-only access for non-root, support
    DragonFly BSD, support extended config space.</changelog>
  <changelog author="msuchanek@suse.com" date="1590062400">- Fix lspci outputs few of the VPD data fields are displayed as unknown (bsc#1170554, ltc#185587).
  Added:
  * pciutils-VPD-When-printing-item-IDs-escape-non-ASCII-characte.patch
  * pciutils-VPD-Cleanup.patch
  * pciutils-Add-decoding-of-vendor-specific-VPD-fields.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603972800">- Add decode support for RCECs [jsc#SLE-13735]
- added patches
  https://github.com/pciutils/pciutils/commit/e12bd01eea67ca8cf539263124843ba281eb6ecc
  + pciutils-add-decode-support-for-RCECs.patch</changelog>
  <changelog author="vliaskovitis@suse.com" date="1643025600">- Add pciutils-Add-PCIe-5.0-data-rate-32-GT-s-support.patch
  Add pciutils-Add-PCIe-6.0-data-rate-64-GT-s-support.patch
  (bsc#1192862)</changelog>
  <changelog author="psimons@suse.com" date="1696420800">- Apply "lspci-Fixed-buffer-overflows-in-ls-tree.c.patch" to fix a
  buffer overflow error that would cause lspci to crash on systems
  with complex topologies. [bsc#1215265]
- Add "pciutils.keyring" so that the tarball's signature can be
  verified at build time.
- Use "%license" tag instead of "%doc" to install the package's
  license file.</changelog>
</package>
<package pkgid="da051809c0150d165b146e217514ab650977e991b00bf5eb914e35c987b9e4a4" name="pciutils" arch="x86_64">
  <version epoch="0" ver="3.5.6" rel="150300.13.6.1"/>
  <changelog author="tchvatal@suse.com" date="1416312000">- Version bump to 3.3.0:
  * Device names exported by BIOS are displayed on Linux.
  * On Linux systems, HWDB is used to look up device names
    when our ID database gives no match. (More precisely,
    HWDB is consulted after local pci.ids, but before using
    network to query online pci.ids.) Thanks to Tom Gundersen
    for the initial patch.
  * Added experimental back-end for OS X / Darwin. Thanks to
    Richard Yao for providing it.
  * Filters now support matching by device class. Original
    patch by Matthew Wilcox, wrappers for ABI compatibility
    by me.
  * Interrupt Pin and Interrupt Line registers are displayed
    for bridge devices, too.
  * Several portability bugs have been fixed.
  * Several typos have been fixed. Also, use of questionable
    constructs in man pages has been reduced.
  * PCIe link capabilities now include the ASPMOptComp bit.
  * The "CRS Software Visibility" bit is now decoded properly.
  * Updated pci.ids to the current snapshot of the database.
- Refresh patch:
  * pciutils-endianh.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1441540800">- Update to 3.3.1
  * Removed hacks for backward compatibility with Linux libc5,
    which were breaking newer non-glibc Linux systems. Thanks
    to Felix Janda.
  * Display VirtIO vendor-specific capability. Patch by Gerd
    Hoffmann.
  * Fixed memory leak in name cache.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="mpluskal@suse.com" date="1447416000">- Update to 3.4.0
  * On Linux, we report NUMA nodes of devices.
  * The sysfs back-end does not die on read errors
    of optional attributes. Instead, a warning is produced.
  * Fixed several minor bugs.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="jengelh@inai.de" date="1448107200">- Summary update</changelog>
  <changelog author="tchvatal@suse.com" date="1452254400">- Version update to 3.4.1:
  * New capabilities decoded: Process Address Space, Page Request
    Interface, Enhanced Allocation. Thanks to David Daney and
    David Woodhouse.
  * DevCap SlotPowerLimit is now decoded for all components with
    upstream ports.</changelog>
  <changelog author="mpluskal@suse.com" date="1463745600">- Update to version 3.5.0:
  * New capabilities decoded: Downstream Port Containment,
    Precision Time Measurement. Thanks to Keith Busch and
    Jonathan Yong.
  * Domain numbers extended to 31 bits. This will be used by the
    Linux kernel on some machines in near future.
  * Enhanced allocation regions are now decoded on Linux.
  * The NetBSD back-end supports PCIe extended configuration space.
  * Updated pci.ids to the current snapshot of the database.</changelog>
  <changelog author="mpluskal@suse.com" date="1464177600">- Update to version 3.5.1:
  * Fixed symbol versioning of pci_init().</changelog>
  <changelog author="mpluskal@suse.com" date="1488196800">- Update to version 3.5.4:
  * Previous version broke compilation on systems, for which
    lib/types.h did not provide a 64-bit integer type. It is
    provided everywhere now.
- Changes for version 3.5.3:
  * When lspci looks for Linux kernel modules, it uses the default
  path to module directory provided by libkmod. Previously,
  it tried to construct the path explicitly, which need not
  work on all systems.
  * Improved formatting of memory and I/O ranges behind a bridge.
  * PCIe link capabilities now display GEN4 speed (16GT/s).
  * PCIe device capabilities now show bits related to atomic
    operations.
- Changes for version 3.5.2:
  * The L1 power management capability is now decoded more
  thoroughly. Thanks to Rajat Jain for the patch.
  * The table of configuration registers used by setpci
  had a bug in the definition of SUBSYSTEM_VENDOR_ID.</changelog>
  <changelog author="aavindraa@gmail.com" date="1510401600">- Update to version 3.5.5
  * Better decoding of AER capability.
  * "Slot Implemented" flag is decoded for PCI/PCI-X to PCIe bridges.
  * Minor fixes of decoding other capabilities.
  * As usual, updated pci.ids to the current snapshot of the
    database.
- cleanup with spec-cleaner
- switch from ftp to https
- track signature</changelog>
  <changelog author="aavindraa@gmail.com" date="1511092800">- Update to version 3.5.6
  * MN VPD keyword is decoded correctly.
  * As usual, updated pci.ids to the current snapshot of the
    database.
  * FreeBSD back-end: read-only access for non-root, support
    DragonFly BSD, support extended config space.</changelog>
  <changelog author="msuchanek@suse.com" date="1590062400">- Fix lspci outputs few of the VPD data fields are displayed as unknown (bsc#1170554, ltc#185587).
  Added:
  * pciutils-VPD-When-printing-item-IDs-escape-non-ASCII-characte.patch
  * pciutils-VPD-Cleanup.patch
  * pciutils-Add-decoding-of-vendor-specific-VPD-fields.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1603972800">- Add decode support for RCECs [jsc#SLE-13735]
- added patches
  https://github.com/pciutils/pciutils/commit/e12bd01eea67ca8cf539263124843ba281eb6ecc
  + pciutils-add-decode-support-for-RCECs.patch</changelog>
  <changelog author="vliaskovitis@suse.com" date="1643025600">- Add pciutils-Add-PCIe-5.0-data-rate-32-GT-s-support.patch
  Add pciutils-Add-PCIe-6.0-data-rate-64-GT-s-support.patch
  (bsc#1192862)</changelog>
  <changelog author="psimons@suse.com" date="1696420800">- Apply "lspci-Fixed-buffer-overflows-in-ls-tree.c.patch" to fix a
  buffer overflow error that would cause lspci to crash on systems
  with complex topologies. [bsc#1215265]
- Add "pciutils.keyring" so that the tarball's signature can be
  verified at build time.
- Use "%license" tag instead of "%doc" to install the package's
  license file.</changelog>
</package>
<package pkgid="b99320be850809ac61b5145f758c27b216ba248e03ab6df15945c3cf6b19d8bc" name="perl-Bootloader" arch="aarch64">
  <version epoch="0" ver="0.945" rel="150400.3.9.1"/>
  <changelog author="wfeldt@opensuse.org" date="1571054400">- merge gh#openSUSE/perl-bootloader#123
- Accept sysconfig values without quotes
- 0.926</changelog>
  <changelog author="wfeldt@opensuse.org" date="1587729600">- merge gh#openSUSE/perl-bootloader#126
- always install EFI fallback boot for aarch64 (bsc#1167015)
- 0.927</changelog>
  <changelog author="wfeldt@opensuse.org" date="1591185600">- merge gh#openSUSE/perl-bootloader#127
- use correct target name on aarch64 (bsc#1172293)
- 0.928</changelog>
  <changelog author="wfeldt@opensuse.org" date="1594728000">- merge gh#openSUSE/perl-bootloader#128
- Do not warn about missing SECURE_BOOT sysconfig
- 0.929</changelog>
  <changelog author="wfeldt@opensuse.org" date="1595505600">- merge gh#openSUSE/perl-bootloader#130
- Throw less warnings about fstab
- 0.930</changelog>
  <changelog author="wfeldt@opensuse.org" date="1595592000">- merge gh#openSUSE/perl-bootloader#129
- Check tpm.mod in the new grub2 directory (bsc#1174320)
- 0.931</changelog>
  <changelog author="wfeldt@opensuse.org" date="1603108800">- merge gh#openSUSE/perl-bootloader#131
- grub2 install: honor UPDATE_NVRAM in /etc/sysconfig/bootloader
  (bsc#1157550 jsc#SLE-11500).
- 0.932</changelog>
  <changelog author="wfeldt@opensuse.org" date="1613044800">- merge gh#openSUSE/perl-bootloader#133
- use shim on aarch64 (jsc#SLE-15823, jsc#SLE-15020)
- 0.933</changelog>
  <changelog author="wfeldt@opensuse.org" date="1618488000">- merge gh#openSUSE/perl-bootloader#134
- install with --removable if efivars are not writable
  (bsc#1182749, bsc#1174111, bsc#1184160)
- fix whitespace
- 0.934</changelog>
  <changelog author="wfeldt@opensuse.org" date="1627387200">- merge gh#openSUSE/perl-bootloader#135
- fix typo in update-bootloader
- 0.935</changelog>
  <changelog author="wfeldt@opensuse.org" date="1631793600">- merge gh#openSUSE/perl-bootloader#136
- report error if config file could not be updated (bsc#1188768)
- 0.936</changelog>
  <changelog author="wfeldt@opensuse.org" date="1642075200">- merge gh#openSUSE/perl-bootloader#137
- grub2 install: Support secure boot on powerpc (bsc#1192764
  jsc#SLE-18271).
- 0.937</changelog>
  <changelog author="wfeldt@opensuse.org" date="1649332800">- merge gh#openSUSE/perl-bootloader#138
- grub2/install: reset error code when passing through recover code
  (bsc#1198197)
- 0.938</changelog>
  <changelog author="wfeldt@opensuse.org" date="1651060800">- merge gh#openSUSE/perl-bootloader#139
- fix sysconfig parsing (bsc#1198828)
- 0.939</changelog>
  <changelog author="wfeldt@opensuse.org" date="1670241600">- merge gh#openSUSE/perl-bootloader#140
- add basic support for systemd-boot
- 0.940</changelog>
  <changelog author="wfeldt@opensuse.org" date="1673524800">- merge gh#openSUSE/perl-bootloader#141
- systemd-boot: easier initial setup
- 0.941</changelog>
  <changelog author="wfeldt@opensuse.org" date="1682337600">- merge gh#openSUSE/perl-bootloader#142
- use fw_platform_size to distinguish between 32 bit and 64 bit
  UEFI platforms (bsc#1208003)
- 0.942</changelog>
  <changelog author="wfeldt@opensuse.org" date="1685534400">- merge gh#openSUSE/perl-bootloader#147
- UEFI: update also default location, if it is controlled by SUSE
  (bsc#1210799, bsc#1201399)
- 0.943</changelog>
  <changelog author="wfeldt@opensuse.org" date="1688126400">- merge gh#openSUSE/perl-bootloader#152
- use signed grub EFI binary when updating grub in default EFI
  location (bsc#1210799)
- check whether grub2-install supports --suse-force-signed option
- 0.944</changelog>
  <changelog author="wfeldt@opensuse.org" date="1694088000">- merge gh#openSUSE/perl-bootloader#157
- bootloader_entry script can have an optional 'force-default'
  argument (bsc#1215064)
- skip warning about unsupported options when in compat mode
- 0.945</changelog>
</package>
<package pkgid="093cc4162472563605e40c66a0308608485e4b7293c6fc64e98142110819234f" name="perl-Bootloader" arch="s390x">
  <version epoch="0" ver="0.945" rel="150400.3.9.1"/>
  <changelog author="wfeldt@opensuse.org" date="1571054400">- merge gh#openSUSE/perl-bootloader#123
- Accept sysconfig values without quotes
- 0.926</changelog>
  <changelog author="wfeldt@opensuse.org" date="1587729600">- merge gh#openSUSE/perl-bootloader#126
- always install EFI fallback boot for aarch64 (bsc#1167015)
- 0.927</changelog>
  <changelog author="wfeldt@opensuse.org" date="1591185600">- merge gh#openSUSE/perl-bootloader#127
- use correct target name on aarch64 (bsc#1172293)
- 0.928</changelog>
  <changelog author="wfeldt@opensuse.org" date="1594728000">- merge gh#openSUSE/perl-bootloader#128
- Do not warn about missing SECURE_BOOT sysconfig
- 0.929</changelog>
  <changelog author="wfeldt@opensuse.org" date="1595505600">- merge gh#openSUSE/perl-bootloader#130
- Throw less warnings about fstab
- 0.930</changelog>
  <changelog author="wfeldt@opensuse.org" date="1595592000">- merge gh#openSUSE/perl-bootloader#129
- Check tpm.mod in the new grub2 directory (bsc#1174320)
- 0.931</changelog>
  <changelog author="wfeldt@opensuse.org" date="1603108800">- merge gh#openSUSE/perl-bootloader#131
- grub2 install: honor UPDATE_NVRAM in /etc/sysconfig/bootloader
  (bsc#1157550 jsc#SLE-11500).
- 0.932</changelog>
  <changelog author="wfeldt@opensuse.org" date="1613044800">- merge gh#openSUSE/perl-bootloader#133
- use shim on aarch64 (jsc#SLE-15823, jsc#SLE-15020)
- 0.933</changelog>
  <changelog author="wfeldt@opensuse.org" date="1618488000">- merge gh#openSUSE/perl-bootloader#134
- install with --removable if efivars are not writable
  (bsc#1182749, bsc#1174111, bsc#1184160)
- fix whitespace
- 0.934</changelog>
  <changelog author="wfeldt@opensuse.org" date="1627387200">- merge gh#openSUSE/perl-bootloader#135
- fix typo in update-bootloader
- 0.935</changelog>
  <changelog author="wfeldt@opensuse.org" date="1631793600">- merge gh#openSUSE/perl-bootloader#136
- report error if config file could not be updated (bsc#1188768)
- 0.936</changelog>
  <changelog author="wfeldt@opensuse.org" date="1642075200">- merge gh#openSUSE/perl-bootloader#137
- grub2 install: Support secure boot on powerpc (bsc#1192764
  jsc#SLE-18271).
- 0.937</changelog>
  <changelog author="wfeldt@opensuse.org" date="1649332800">- merge gh#openSUSE/perl-bootloader#138
- grub2/install: reset error code when passing through recover code
  (bsc#1198197)
- 0.938</changelog>
  <changelog author="wfeldt@opensuse.org" date="1651060800">- merge gh#openSUSE/perl-bootloader#139
- fix sysconfig parsing (bsc#1198828)
- 0.939</changelog>
  <changelog author="wfeldt@opensuse.org" date="1670241600">- merge gh#openSUSE/perl-bootloader#140
- add basic support for systemd-boot
- 0.940</changelog>
  <changelog author="wfeldt@opensuse.org" date="1673524800">- merge gh#openSUSE/perl-bootloader#141
- systemd-boot: easier initial setup
- 0.941</changelog>
  <changelog author="wfeldt@opensuse.org" date="1682337600">- merge gh#openSUSE/perl-bootloader#142
- use fw_platform_size to distinguish between 32 bit and 64 bit
  UEFI platforms (bsc#1208003)
- 0.942</changelog>
  <changelog author="wfeldt@opensuse.org" date="1685534400">- merge gh#openSUSE/perl-bootloader#147
- UEFI: update also default location, if it is controlled by SUSE
  (bsc#1210799, bsc#1201399)
- 0.943</changelog>
  <changelog author="wfeldt@opensuse.org" date="1688126400">- merge gh#openSUSE/perl-bootloader#152
- use signed grub EFI binary when updating grub in default EFI
  location (bsc#1210799)
- check whether grub2-install supports --suse-force-signed option
- 0.944</changelog>
  <changelog author="wfeldt@opensuse.org" date="1694088000">- merge gh#openSUSE/perl-bootloader#157
- bootloader_entry script can have an optional 'force-default'
  argument (bsc#1215064)
- skip warning about unsupported options when in compat mode
- 0.945</changelog>
</package>
<package pkgid="ed73bca7fdbdad353bce73043d156bcc81df05129f0deb67d3998c939c7a24af" name="perl-Bootloader" arch="src">
  <version epoch="0" ver="0.945" rel="150400.3.9.1"/>
  <changelog author="wfeldt@opensuse.org" date="1571054400">- merge gh#openSUSE/perl-bootloader#123
- Accept sysconfig values without quotes
- 0.926</changelog>
  <changelog author="wfeldt@opensuse.org" date="1587729600">- merge gh#openSUSE/perl-bootloader#126
- always install EFI fallback boot for aarch64 (bsc#1167015)
- 0.927</changelog>
  <changelog author="wfeldt@opensuse.org" date="1591185600">- merge gh#openSUSE/perl-bootloader#127
- use correct target name on aarch64 (bsc#1172293)
- 0.928</changelog>
  <changelog author="wfeldt@opensuse.org" date="1594728000">- merge gh#openSUSE/perl-bootloader#128
- Do not warn about missing SECURE_BOOT sysconfig
- 0.929</changelog>
  <changelog author="wfeldt@opensuse.org" date="1595505600">- merge gh#openSUSE/perl-bootloader#130
- Throw less warnings about fstab
- 0.930</changelog>
  <changelog author="wfeldt@opensuse.org" date="1595592000">- merge gh#openSUSE/perl-bootloader#129
- Check tpm.mod in the new grub2 directory (bsc#1174320)
- 0.931</changelog>
  <changelog author="wfeldt@opensuse.org" date="1603108800">- merge gh#openSUSE/perl-bootloader#131
- grub2 install: honor UPDATE_NVRAM in /etc/sysconfig/bootloader
  (bsc#1157550 jsc#SLE-11500).
- 0.932</changelog>
  <changelog author="wfeldt@opensuse.org" date="1613044800">- merge gh#openSUSE/perl-bootloader#133
- use shim on aarch64 (jsc#SLE-15823, jsc#SLE-15020)
- 0.933</changelog>
  <changelog author="wfeldt@opensuse.org" date="1618488000">- merge gh#openSUSE/perl-bootloader#134
- install with --removable if efivars are not writable
  (bsc#1182749, bsc#1174111, bsc#1184160)
- fix whitespace
- 0.934</changelog>
  <changelog author="wfeldt@opensuse.org" date="1627387200">- merge gh#openSUSE/perl-bootloader#135
- fix typo in update-bootloader
- 0.935</changelog>
  <changelog author="wfeldt@opensuse.org" date="1631793600">- merge gh#openSUSE/perl-bootloader#136
- report error if config file could not be updated (bsc#1188768)
- 0.936</changelog>
  <changelog author="wfeldt@opensuse.org" date="1642075200">- merge gh#openSUSE/perl-bootloader#137
- grub2 install: Support secure boot on powerpc (bsc#1192764
  jsc#SLE-18271).
- 0.937</changelog>
  <changelog author="wfeldt@opensuse.org" date="1649332800">- merge gh#openSUSE/perl-bootloader#138
- grub2/install: reset error code when passing through recover code
  (bsc#1198197)
- 0.938</changelog>
  <changelog author="wfeldt@opensuse.org" date="1651060800">- merge gh#openSUSE/perl-bootloader#139
- fix sysconfig parsing (bsc#1198828)
- 0.939</changelog>
  <changelog author="wfeldt@opensuse.org" date="1670241600">- merge gh#openSUSE/perl-bootloader#140
- add basic support for systemd-boot
- 0.940</changelog>
  <changelog author="wfeldt@opensuse.org" date="1673524800">- merge gh#openSUSE/perl-bootloader#141
- systemd-boot: easier initial setup
- 0.941</changelog>
  <changelog author="wfeldt@opensuse.org" date="1682337600">- merge gh#openSUSE/perl-bootloader#142
- use fw_platform_size to distinguish between 32 bit and 64 bit
  UEFI platforms (bsc#1208003)
- 0.942</changelog>
  <changelog author="wfeldt@opensuse.org" date="1685534400">- merge gh#openSUSE/perl-bootloader#147
- UEFI: update also default location, if it is controlled by SUSE
  (bsc#1210799, bsc#1201399)
- 0.943</changelog>
  <changelog author="wfeldt@opensuse.org" date="1688126400">- merge gh#openSUSE/perl-bootloader#152
- use signed grub EFI binary when updating grub in default EFI
  location (bsc#1210799)
- check whether grub2-install supports --suse-force-signed option
- 0.944</changelog>
  <changelog author="wfeldt@opensuse.org" date="1694088000">- merge gh#openSUSE/perl-bootloader#157
- bootloader_entry script can have an optional 'force-default'
  argument (bsc#1215064)
- skip warning about unsupported options when in compat mode
- 0.945</changelog>
</package>
<package pkgid="bbf74264fe14c7f8882a3dd6365d3cd54020ffb42acde5dec5b5ed243b30821f" name="perl-Bootloader" arch="x86_64">
  <version epoch="0" ver="0.945" rel="150400.3.9.1"/>
  <changelog author="wfeldt@opensuse.org" date="1571054400">- merge gh#openSUSE/perl-bootloader#123
- Accept sysconfig values without quotes
- 0.926</changelog>
  <changelog author="wfeldt@opensuse.org" date="1587729600">- merge gh#openSUSE/perl-bootloader#126
- always install EFI fallback boot for aarch64 (bsc#1167015)
- 0.927</changelog>
  <changelog author="wfeldt@opensuse.org" date="1591185600">- merge gh#openSUSE/perl-bootloader#127
- use correct target name on aarch64 (bsc#1172293)
- 0.928</changelog>
  <changelog author="wfeldt@opensuse.org" date="1594728000">- merge gh#openSUSE/perl-bootloader#128
- Do not warn about missing SECURE_BOOT sysconfig
- 0.929</changelog>
  <changelog author="wfeldt@opensuse.org" date="1595505600">- merge gh#openSUSE/perl-bootloader#130
- Throw less warnings about fstab
- 0.930</changelog>
  <changelog author="wfeldt@opensuse.org" date="1595592000">- merge gh#openSUSE/perl-bootloader#129
- Check tpm.mod in the new grub2 directory (bsc#1174320)
- 0.931</changelog>
  <changelog author="wfeldt@opensuse.org" date="1603108800">- merge gh#openSUSE/perl-bootloader#131
- grub2 install: honor UPDATE_NVRAM in /etc/sysconfig/bootloader
  (bsc#1157550 jsc#SLE-11500).
- 0.932</changelog>
  <changelog author="wfeldt@opensuse.org" date="1613044800">- merge gh#openSUSE/perl-bootloader#133
- use shim on aarch64 (jsc#SLE-15823, jsc#SLE-15020)
- 0.933</changelog>
  <changelog author="wfeldt@opensuse.org" date="1618488000">- merge gh#openSUSE/perl-bootloader#134
- install with --removable if efivars are not writable
  (bsc#1182749, bsc#1174111, bsc#1184160)
- fix whitespace
- 0.934</changelog>
  <changelog author="wfeldt@opensuse.org" date="1627387200">- merge gh#openSUSE/perl-bootloader#135
- fix typo in update-bootloader
- 0.935</changelog>
  <changelog author="wfeldt@opensuse.org" date="1631793600">- merge gh#openSUSE/perl-bootloader#136
- report error if config file could not be updated (bsc#1188768)
- 0.936</changelog>
  <changelog author="wfeldt@opensuse.org" date="1642075200">- merge gh#openSUSE/perl-bootloader#137
- grub2 install: Support secure boot on powerpc (bsc#1192764
  jsc#SLE-18271).
- 0.937</changelog>
  <changelog author="wfeldt@opensuse.org" date="1649332800">- merge gh#openSUSE/perl-bootloader#138
- grub2/install: reset error code when passing through recover code
  (bsc#1198197)
- 0.938</changelog>
  <changelog author="wfeldt@opensuse.org" date="1651060800">- merge gh#openSUSE/perl-bootloader#139
- fix sysconfig parsing (bsc#1198828)
- 0.939</changelog>
  <changelog author="wfeldt@opensuse.org" date="1670241600">- merge gh#openSUSE/perl-bootloader#140
- add basic support for systemd-boot
- 0.940</changelog>
  <changelog author="wfeldt@opensuse.org" date="1673524800">- merge gh#openSUSE/perl-bootloader#141
- systemd-boot: easier initial setup
- 0.941</changelog>
  <changelog author="wfeldt@opensuse.org" date="1682337600">- merge gh#openSUSE/perl-bootloader#142
- use fw_platform_size to distinguish between 32 bit and 64 bit
  UEFI platforms (bsc#1208003)
- 0.942</changelog>
  <changelog author="wfeldt@opensuse.org" date="1685534400">- merge gh#openSUSE/perl-bootloader#147
- UEFI: update also default location, if it is controlled by SUSE
  (bsc#1210799, bsc#1201399)
- 0.943</changelog>
  <changelog author="wfeldt@opensuse.org" date="1688126400">- merge gh#openSUSE/perl-bootloader#152
- use signed grub EFI binary when updating grub in default EFI
  location (bsc#1210799)
- check whether grub2-install supports --suse-force-signed option
- 0.944</changelog>
  <changelog author="wfeldt@opensuse.org" date="1694088000">- merge gh#openSUSE/perl-bootloader#157
- bootloader_entry script can have an optional 'force-default'
  argument (bsc#1215064)
- skip warning about unsupported options when in compat mode
- 0.945</changelog>
</package>
<package pkgid="c95a10ef698f439c890095b89c392469d76001b315c4759eace72205b6710e29" name="perl-Git" arch="aarch64">
  <version epoch="0" ver="2.35.3" rel="150300.10.30.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1629547200">- git 2.33.0:
  * "git send-email" learned the "--sendmail-cmd" command line option
    and the "sendemail.sendmailCmd" configuration variable, which is a
    more sensible approach than the current way of repurposing the
    "smtp-server" that is meant to name the server to instead name the
    command to talk to the server.
  * The userdiff pattern for C# learned the token "record".
  * "git rev-list" learns to omit the "commit &lt;object-name&gt;" header
    lines from the output with the `--no-commit-header` option.
  * "git worktree add --lock" learned to record why the worktree is
    locked with a custom message.
  * internal improvements including performance optimizations
  * a number of bug fixes</changelog>
  <changelog author="jsegitz@suse.com" date="1632139200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * git-daemon.service</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1634126400">- git 2.33.1:
  * fix "git pull" and "git rebase -r" various corner cases and bugs
  * "git commit --fixup" now works with "--edit" again.
  * Fix "git send-email" unwanted threading
  * Fix output from "git fast-export" anonymization feature
    showing an annotated tag incorrectly.
  * Fixes for various command output
  * fix "git difftool --dir-diff" mishandling symbolic links
  * Redact sensitive data in the HTTP trace for HTTP/2 requests
  * further bug fixes for various git operations</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634731200">- Add CONFIG parameter to %sysusers_generate_pre
- Remove unneeded SHELL in git-daemon.conf
- Fix sysusers usage in spec file
- Require nogroup group for %pre (bsc#1192023)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637236800">- git 2.34.0:
  * Release notes:
    https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt</changelog>
  <changelog author="dmueller@suse.com" date="1637496000">- fix url</changelog>
  <changelog author="dmueller@suse.com" date="1637928000">- update to 2.34.1 (bsc#1193722):
  * "git grep" looking in a blob that has non-UTF8 payload was
    completely broken when linked with certain versions of PCREv2
    library in the latest release.
  * "git pull" with any strategy when the other side is behind us
    should succeed as it is a no-op, but doesn't.
  * An earlier change in 2.34.0 caused JGit application (that abused
    GIT_EDITOR mechanism when invoking "git config") to get stuck with
    a SIGTTOU signal; it has been reverted.
  * An earlier change that broke .gitignore matching has been reverted.
  * SubmittingPatches document gained a syntactically incorrect mark-up,
    which has been corrected.</changelog>
  <changelog author="dmueller@suse.com" date="1643371200">- update to 2.35.0:
  * "_" is now treated as any other URL-valid characters in an URL when
  matching the per-URL configuration variable names.
  * The color palette used by "git grep" has been updated to match that
  of GNU grep.
  * "git status --porcelain=v2" now show the number of stash entries
  with --show-stash like the normal output does.
  * "git stash" learned the "--staged" option to stash away what has
  been added to the index (and nothing else).
  * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for
  the newly created branch if "git init" is run.
  * Various operating modes of "git reset" have been made to work
  better with the sparse index.
  * "git submodule deinit" for a submodule whose .git metadata
  directory is embedded in its working tree refused to work, until
  the submodule gets converted to use the "absorbed" form where the
  metadata directory is stored in superproject, and a gitfile at the
  top-level of the working tree of the submodule points at it.  The
  command is taught to convert such submodules to the absorbed form
  as needed.
  * The completion script (in contrib/) learns that the "--date"
  option of commands from the "git log" family takes "human" and
  "auto" as valid values.
  * "Zealous diff3" style of merge conflict presentation has been added.
  * The "git log --format=%(describe)" placeholder has been extended to
  allow passing selected command-line options to the underlying "git
  describe" command.
  * "default" and "reset" have been added to our color palette.
  * The cryptographic signing using ssh keys can specify literal keys
  for keytypes whose name do not begin with the "ssh-" prefix by
  using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256").
  * "git fetch" without the "--update-head-ok" option ought to protect
  a checked out branch from getting updated, to prevent the working
  tree that checks it out to go out of sync.  The code was written
  before the use of "git worktree" got widespread, and only checked
  the branch that was checked out in the current worktree, which has
  been updated.
  * "git name-rev" has been tweaked to give output that is shorter and
  easier to understand.
  * "git apply" has been taught to ignore a message without a patch
  with the "--allow-empty" option.  It also learned to honor the
  "--quiet" option given from the command line.
  * The "init" and "set" subcommands in "git sparse-checkout" have been
  unified for a better user experience and performance.
  * Many git commands that deal with working tree files try to remove a
  directory that becomes empty (i.e. "git switch" from a branch that
  has the directory to another branch that does not would attempt
  remove all files in the directory and the directory itself).  This
  drops users into an unfamiliar situation if the command was run in
  a subdirectory that becomes subject to removal due to the command.
  The commands have been taught to keep an empty directory if it is
  the directory they were started in to avoid surprising users.
  * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is
  done to a piece of e-mail without a patch in it.
  * The default merge message prepared by "git merge" records the name
  of the current branch; the name can be overridden with a new option
  to allow users to pretend a merge is made on a different branch.
  * The way "git p4" shows file sizes in its output has been updated to
  use human-readable units.
  * "git -c branch.autosetupmerge=inherit branch new old" makes "new"
  to have the same upstream as the "old" branch, instead of marking
  "old" itself as its upstream.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1643457600">- update to 2.35.1:
  * fix "rebase" and "stash" in a secondary worktree</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645444800">- "Downgrade" git-gui and gitk Recommends to Suggests.</changelog>
  <changelog author="chris@computersalat.de" date="1646913600">- fix deps for SLES 12</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1649764800">- git 2.35.2 (CVE-2022-24765, bsc#1198234):
  * CVE-2022-24765: git may execute commands defined by other users
    from unexpected worktrees</changelog>
  <changelog author="olaf@aepfle.de" date="1649851200">- Require bash in git-daemon because the service file uses it
- Reword git-daemon.service description to get a useful sentence
  in journalctl -b</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1649937600">- git 2.35.3:
  * usability fix-up for CVE-2022-24765 bsc#1198234:
    '*' can be used as the value for the `safe.directory` variable
    to signal that the user considers that any directory is safe.
  * The code that was meant to parse the new `safe.directory`
    configuration variable was not checking what configuration
    variable was being fed to it</changelog>
  <changelog author="danilo.spinella@suse.com" date="1657713600">- Follow up fix for CVE-2022-24765, potential command injection
  via git worktree.
  (CVE-2022-29187, bsc#1201431)
  * fix-CVE-2022-29187.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1666353600">- Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to
  arbitrary heap writes and remote code execution
  (CVE-2022-39260, bsc#1204456)
  fix-CVE-2022-39260.patch
- Fix CVE-2022-39253, dereference issue with symbolic links via
  the `--local` clone mechanism
  (CVE-2022-39253, bsc#1204455)
  fix-CVE-2022-39253.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1673524800">- Fix CVE-2022-41903, heap overflow in `git archive` and
  `git log --format`
  (CVE-2022-41903, bsc#1207033)
  * fix-CVE-2022-41903.patch
- Fix CVE-2022-23521, gitattributes parsing integer overflow
  (CVE-2022-23521, bsc#1207032)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1676289600">- Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked
  into using its local clone optimization even when using a non-local transport
  (CVE-2023-22490, bsc#1208027)
- Fix CVE-2023-23946, a path outside the working tree can be overwritten as the
  user who is running "git apply"
  (CVE-2023-23946, bsc#1208028)
  * fix-CVE-2023-22490-1.patch
  * fix-CVE-2023-22490-2.patch
  * fix-CVE-2023-22490-3.patch
  * fix-CVE-2023-22490-4.patch</changelog>
  <changelog author="psimons@suse.com" date="1682337600">- Apply "CVE-2023-25652.patch" to fix a security vulnerability
  where by feeding a specially crafted input to `git apply
  - -reject`, a path outside the working tree could be overwritten
  with partially controlled contents (corresponding to the rejected
  hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686]
- Apply "CVE-2023-25815.patch" to fix a security vulnerability that
  exists when Git is compiled with runtime prefix support and runs
  without translated messages, then it still used the gettext
  machinery to display messages, which subsequently potentially
  looked for translated messages in unexpected places. This allowed
  for malicious placement of crafted messages. [CVE-2023-25815,
  bsc#1210686]
- Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch",
  "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a
  security vulnerability that occurred when renaming or deleting a
  section from a configuration file, then certain malicious
  configuration values might have been misinterpreted as the
  beginning of a new configuration section, leading to arbitrary
  configuration injection. [CVE-2023-29007, bsc#1210686]</changelog>
  <changelog author="msuchanek@suse.com" date="1695384000">- Downgrade openssh dependency to recommends (bsc#1215533)</changelog>
</package>
<package pkgid="b25e9b58c7c6adc03087137d1a0c3f0656e095c6a091e25062db0c05a8cfaf66" name="perl-Git" arch="s390x">
  <version epoch="0" ver="2.35.3" rel="150300.10.30.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1629547200">- git 2.33.0:
  * "git send-email" learned the "--sendmail-cmd" command line option
    and the "sendemail.sendmailCmd" configuration variable, which is a
    more sensible approach than the current way of repurposing the
    "smtp-server" that is meant to name the server to instead name the
    command to talk to the server.
  * The userdiff pattern for C# learned the token "record".
  * "git rev-list" learns to omit the "commit &lt;object-name&gt;" header
    lines from the output with the `--no-commit-header` option.
  * "git worktree add --lock" learned to record why the worktree is
    locked with a custom message.
  * internal improvements including performance optimizations
  * a number of bug fixes</changelog>
  <changelog author="jsegitz@suse.com" date="1632139200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * git-daemon.service</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1634126400">- git 2.33.1:
  * fix "git pull" and "git rebase -r" various corner cases and bugs
  * "git commit --fixup" now works with "--edit" again.
  * Fix "git send-email" unwanted threading
  * Fix output from "git fast-export" anonymization feature
    showing an annotated tag incorrectly.
  * Fixes for various command output
  * fix "git difftool --dir-diff" mishandling symbolic links
  * Redact sensitive data in the HTTP trace for HTTP/2 requests
  * further bug fixes for various git operations</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634731200">- Add CONFIG parameter to %sysusers_generate_pre
- Remove unneeded SHELL in git-daemon.conf
- Fix sysusers usage in spec file
- Require nogroup group for %pre (bsc#1192023)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637236800">- git 2.34.0:
  * Release notes:
    https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt</changelog>
  <changelog author="dmueller@suse.com" date="1637496000">- fix url</changelog>
  <changelog author="dmueller@suse.com" date="1637928000">- update to 2.34.1 (bsc#1193722):
  * "git grep" looking in a blob that has non-UTF8 payload was
    completely broken when linked with certain versions of PCREv2
    library in the latest release.
  * "git pull" with any strategy when the other side is behind us
    should succeed as it is a no-op, but doesn't.
  * An earlier change in 2.34.0 caused JGit application (that abused
    GIT_EDITOR mechanism when invoking "git config") to get stuck with
    a SIGTTOU signal; it has been reverted.
  * An earlier change that broke .gitignore matching has been reverted.
  * SubmittingPatches document gained a syntactically incorrect mark-up,
    which has been corrected.</changelog>
  <changelog author="dmueller@suse.com" date="1643371200">- update to 2.35.0:
  * "_" is now treated as any other URL-valid characters in an URL when
  matching the per-URL configuration variable names.
  * The color palette used by "git grep" has been updated to match that
  of GNU grep.
  * "git status --porcelain=v2" now show the number of stash entries
  with --show-stash like the normal output does.
  * "git stash" learned the "--staged" option to stash away what has
  been added to the index (and nothing else).
  * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for
  the newly created branch if "git init" is run.
  * Various operating modes of "git reset" have been made to work
  better with the sparse index.
  * "git submodule deinit" for a submodule whose .git metadata
  directory is embedded in its working tree refused to work, until
  the submodule gets converted to use the "absorbed" form where the
  metadata directory is stored in superproject, and a gitfile at the
  top-level of the working tree of the submodule points at it.  The
  command is taught to convert such submodules to the absorbed form
  as needed.
  * The completion script (in contrib/) learns that the "--date"
  option of commands from the "git log" family takes "human" and
  "auto" as valid values.
  * "Zealous diff3" style of merge conflict presentation has been added.
  * The "git log --format=%(describe)" placeholder has been extended to
  allow passing selected command-line options to the underlying "git
  describe" command.
  * "default" and "reset" have been added to our color palette.
  * The cryptographic signing using ssh keys can specify literal keys
  for keytypes whose name do not begin with the "ssh-" prefix by
  using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256").
  * "git fetch" without the "--update-head-ok" option ought to protect
  a checked out branch from getting updated, to prevent the working
  tree that checks it out to go out of sync.  The code was written
  before the use of "git worktree" got widespread, and only checked
  the branch that was checked out in the current worktree, which has
  been updated.
  * "git name-rev" has been tweaked to give output that is shorter and
  easier to understand.
  * "git apply" has been taught to ignore a message without a patch
  with the "--allow-empty" option.  It also learned to honor the
  "--quiet" option given from the command line.
  * The "init" and "set" subcommands in "git sparse-checkout" have been
  unified for a better user experience and performance.
  * Many git commands that deal with working tree files try to remove a
  directory that becomes empty (i.e. "git switch" from a branch that
  has the directory to another branch that does not would attempt
  remove all files in the directory and the directory itself).  This
  drops users into an unfamiliar situation if the command was run in
  a subdirectory that becomes subject to removal due to the command.
  The commands have been taught to keep an empty directory if it is
  the directory they were started in to avoid surprising users.
  * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is
  done to a piece of e-mail without a patch in it.
  * The default merge message prepared by "git merge" records the name
  of the current branch; the name can be overridden with a new option
  to allow users to pretend a merge is made on a different branch.
  * The way "git p4" shows file sizes in its output has been updated to
  use human-readable units.
  * "git -c branch.autosetupmerge=inherit branch new old" makes "new"
  to have the same upstream as the "old" branch, instead of marking
  "old" itself as its upstream.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1643457600">- update to 2.35.1:
  * fix "rebase" and "stash" in a secondary worktree</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645444800">- "Downgrade" git-gui and gitk Recommends to Suggests.</changelog>
  <changelog author="chris@computersalat.de" date="1646913600">- fix deps for SLES 12</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1649764800">- git 2.35.2 (CVE-2022-24765, bsc#1198234):
  * CVE-2022-24765: git may execute commands defined by other users
    from unexpected worktrees</changelog>
  <changelog author="olaf@aepfle.de" date="1649851200">- Require bash in git-daemon because the service file uses it
- Reword git-daemon.service description to get a useful sentence
  in journalctl -b</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1649937600">- git 2.35.3:
  * usability fix-up for CVE-2022-24765 bsc#1198234:
    '*' can be used as the value for the `safe.directory` variable
    to signal that the user considers that any directory is safe.
  * The code that was meant to parse the new `safe.directory`
    configuration variable was not checking what configuration
    variable was being fed to it</changelog>
  <changelog author="danilo.spinella@suse.com" date="1657713600">- Follow up fix for CVE-2022-24765, potential command injection
  via git worktree.
  (CVE-2022-29187, bsc#1201431)
  * fix-CVE-2022-29187.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1666353600">- Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to
  arbitrary heap writes and remote code execution
  (CVE-2022-39260, bsc#1204456)
  fix-CVE-2022-39260.patch
- Fix CVE-2022-39253, dereference issue with symbolic links via
  the `--local` clone mechanism
  (CVE-2022-39253, bsc#1204455)
  fix-CVE-2022-39253.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1673524800">- Fix CVE-2022-41903, heap overflow in `git archive` and
  `git log --format`
  (CVE-2022-41903, bsc#1207033)
  * fix-CVE-2022-41903.patch
- Fix CVE-2022-23521, gitattributes parsing integer overflow
  (CVE-2022-23521, bsc#1207032)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1676289600">- Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked
  into using its local clone optimization even when using a non-local transport
  (CVE-2023-22490, bsc#1208027)
- Fix CVE-2023-23946, a path outside the working tree can be overwritten as the
  user who is running "git apply"
  (CVE-2023-23946, bsc#1208028)
  * fix-CVE-2023-22490-1.patch
  * fix-CVE-2023-22490-2.patch
  * fix-CVE-2023-22490-3.patch
  * fix-CVE-2023-22490-4.patch</changelog>
  <changelog author="psimons@suse.com" date="1682337600">- Apply "CVE-2023-25652.patch" to fix a security vulnerability
  where by feeding a specially crafted input to `git apply
  - -reject`, a path outside the working tree could be overwritten
  with partially controlled contents (corresponding to the rejected
  hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686]
- Apply "CVE-2023-25815.patch" to fix a security vulnerability that
  exists when Git is compiled with runtime prefix support and runs
  without translated messages, then it still used the gettext
  machinery to display messages, which subsequently potentially
  looked for translated messages in unexpected places. This allowed
  for malicious placement of crafted messages. [CVE-2023-25815,
  bsc#1210686]
- Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch",
  "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a
  security vulnerability that occurred when renaming or deleting a
  section from a configuration file, then certain malicious
  configuration values might have been misinterpreted as the
  beginning of a new configuration section, leading to arbitrary
  configuration injection. [CVE-2023-29007, bsc#1210686]</changelog>
  <changelog author="msuchanek@suse.com" date="1695384000">- Downgrade openssh dependency to recommends (bsc#1215533)</changelog>
</package>
<package pkgid="3e5d58db6b48d7153de38bcd25e186fca8c56ca8e18af940779d4d30f2756b78" name="perl-Git" arch="x86_64">
  <version epoch="0" ver="2.35.3" rel="150300.10.30.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1629547200">- git 2.33.0:
  * "git send-email" learned the "--sendmail-cmd" command line option
    and the "sendemail.sendmailCmd" configuration variable, which is a
    more sensible approach than the current way of repurposing the
    "smtp-server" that is meant to name the server to instead name the
    command to talk to the server.
  * The userdiff pattern for C# learned the token "record".
  * "git rev-list" learns to omit the "commit &lt;object-name&gt;" header
    lines from the output with the `--no-commit-header` option.
  * "git worktree add --lock" learned to record why the worktree is
    locked with a custom message.
  * internal improvements including performance optimizations
  * a number of bug fixes</changelog>
  <changelog author="jsegitz@suse.com" date="1632139200">- Added hardening to systemd service(s) (bsc#1181400). Modified:
  * git-daemon.service</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1634126400">- git 2.33.1:
  * fix "git pull" and "git rebase -r" various corner cases and bugs
  * "git commit --fixup" now works with "--edit" again.
  * Fix "git send-email" unwanted threading
  * Fix output from "git fast-export" anonymization feature
    showing an annotated tag incorrectly.
  * Fixes for various command output
  * fix "git difftool --dir-diff" mishandling symbolic links
  * Redact sensitive data in the HTTP trace for HTTP/2 requests
  * further bug fixes for various git operations</changelog>
  <changelog author="gmbr3@opensuse.org" date="1634731200">- Add CONFIG parameter to %sysusers_generate_pre
- Remove unneeded SHELL in git-daemon.conf
- Fix sysusers usage in spec file
- Require nogroup group for %pre (bsc#1192023)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1637236800">- git 2.34.0:
  * Release notes:
    https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.34.0.txt</changelog>
  <changelog author="dmueller@suse.com" date="1637496000">- fix url</changelog>
  <changelog author="dmueller@suse.com" date="1637928000">- update to 2.34.1 (bsc#1193722):
  * "git grep" looking in a blob that has non-UTF8 payload was
    completely broken when linked with certain versions of PCREv2
    library in the latest release.
  * "git pull" with any strategy when the other side is behind us
    should succeed as it is a no-op, but doesn't.
  * An earlier change in 2.34.0 caused JGit application (that abused
    GIT_EDITOR mechanism when invoking "git config") to get stuck with
    a SIGTTOU signal; it has been reverted.
  * An earlier change that broke .gitignore matching has been reverted.
  * SubmittingPatches document gained a syntactically incorrect mark-up,
    which has been corrected.</changelog>
  <changelog author="dmueller@suse.com" date="1643371200">- update to 2.35.0:
  * "_" is now treated as any other URL-valid characters in an URL when
  matching the per-URL configuration variable names.
  * The color palette used by "git grep" has been updated to match that
  of GNU grep.
  * "git status --porcelain=v2" now show the number of stash entries
  with --show-stash like the normal output does.
  * "git stash" learned the "--staged" option to stash away what has
  been added to the index (and nothing else).
  * "git var GIT_DEFAULT_BRANCH" is a way to see what name is used for
  the newly created branch if "git init" is run.
  * Various operating modes of "git reset" have been made to work
  better with the sparse index.
  * "git submodule deinit" for a submodule whose .git metadata
  directory is embedded in its working tree refused to work, until
  the submodule gets converted to use the "absorbed" form where the
  metadata directory is stored in superproject, and a gitfile at the
  top-level of the working tree of the submodule points at it.  The
  command is taught to convert such submodules to the absorbed form
  as needed.
  * The completion script (in contrib/) learns that the "--date"
  option of commands from the "git log" family takes "human" and
  "auto" as valid values.
  * "Zealous diff3" style of merge conflict presentation has been added.
  * The "git log --format=%(describe)" placeholder has been extended to
  allow passing selected command-line options to the underlying "git
  describe" command.
  * "default" and "reset" have been added to our color palette.
  * The cryptographic signing using ssh keys can specify literal keys
  for keytypes whose name do not begin with the "ssh-" prefix by
  using the "key::" prefix mechanism (e.g. "key::ecdsa-sha2-nistp256").
  * "git fetch" without the "--update-head-ok" option ought to protect
  a checked out branch from getting updated, to prevent the working
  tree that checks it out to go out of sync.  The code was written
  before the use of "git worktree" got widespread, and only checked
  the branch that was checked out in the current worktree, which has
  been updated.
  * "git name-rev" has been tweaked to give output that is shorter and
  easier to understand.
  * "git apply" has been taught to ignore a message without a patch
  with the "--allow-empty" option.  It also learned to honor the
  "--quiet" option given from the command line.
  * The "init" and "set" subcommands in "git sparse-checkout" have been
  unified for a better user experience and performance.
  * Many git commands that deal with working tree files try to remove a
  directory that becomes empty (i.e. "git switch" from a branch that
  has the directory to another branch that does not would attempt
  remove all files in the directory and the directory itself).  This
  drops users into an unfamiliar situation if the command was run in
  a subdirectory that becomes subject to removal due to the command.
  The commands have been taught to keep an empty directory if it is
  the directory they were started in to avoid surprising users.
  * "git am" learns "--empty=(stop|drop|keep)" option to tweak what is
  done to a piece of e-mail without a patch in it.
  * The default merge message prepared by "git merge" records the name
  of the current branch; the name can be overridden with a new option
  to allow users to pretend a merge is made on a different branch.
  * The way "git p4" shows file sizes in its output has been updated to
  use human-readable units.
  * "git -c branch.autosetupmerge=inherit branch new old" makes "new"
  to have the same upstream as the "old" branch, instead of marking
  "old" itself as its upstream.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1643457600">- update to 2.35.1:
  * fix "rebase" and "stash" in a secondary worktree</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1645444800">- "Downgrade" git-gui and gitk Recommends to Suggests.</changelog>
  <changelog author="chris@computersalat.de" date="1646913600">- fix deps for SLES 12</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1649764800">- git 2.35.2 (CVE-2022-24765, bsc#1198234):
  * CVE-2022-24765: git may execute commands defined by other users
    from unexpected worktrees</changelog>
  <changelog author="olaf@aepfle.de" date="1649851200">- Require bash in git-daemon because the service file uses it
- Reword git-daemon.service description to get a useful sentence
  in journalctl -b</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1649937600">- git 2.35.3:
  * usability fix-up for CVE-2022-24765 bsc#1198234:
    '*' can be used as the value for the `safe.directory` variable
    to signal that the user considers that any directory is safe.
  * The code that was meant to parse the new `safe.directory`
    configuration variable was not checking what configuration
    variable was being fed to it</changelog>
  <changelog author="danilo.spinella@suse.com" date="1657713600">- Follow up fix for CVE-2022-24765, potential command injection
  via git worktree.
  (CVE-2022-29187, bsc#1201431)
  * fix-CVE-2022-29187.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1666353600">- Fix CVE-2022-39260, overflow in `split_cmdline()`, leading to
  arbitrary heap writes and remote code execution
  (CVE-2022-39260, bsc#1204456)
  fix-CVE-2022-39260.patch
- Fix CVE-2022-39253, dereference issue with symbolic links via
  the `--local` clone mechanism
  (CVE-2022-39253, bsc#1204455)
  fix-CVE-2022-39253.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1673524800">- Fix CVE-2022-41903, heap overflow in `git archive` and
  `git log --format`
  (CVE-2022-41903, bsc#1207033)
  * fix-CVE-2022-41903.patch
- Fix CVE-2022-23521, gitattributes parsing integer overflow
  (CVE-2022-23521, bsc#1207032)</changelog>
  <changelog author="danilo.spinella@suse.com" date="1676289600">- Fix CVE-2023-22490, using a specially-crafted repository, Git can be tricked
  into using its local clone optimization even when using a non-local transport
  (CVE-2023-22490, bsc#1208027)
- Fix CVE-2023-23946, a path outside the working tree can be overwritten as the
  user who is running "git apply"
  (CVE-2023-23946, bsc#1208028)
  * fix-CVE-2023-22490-1.patch
  * fix-CVE-2023-22490-2.patch
  * fix-CVE-2023-22490-3.patch
  * fix-CVE-2023-22490-4.patch</changelog>
  <changelog author="psimons@suse.com" date="1682337600">- Apply "CVE-2023-25652.patch" to fix a security vulnerability
  where by feeding a specially crafted input to `git apply
  - -reject`, a path outside the working tree could be overwritten
  with partially controlled contents (corresponding to the rejected
  hunk(s) from the given patch). [CVE-2023-25652, bsc#1210686]
- Apply "CVE-2023-25815.patch" to fix a security vulnerability that
  exists when Git is compiled with runtime prefix support and runs
  without translated messages, then it still used the gettext
  machinery to display messages, which subsequently potentially
  looked for translated messages in unexpected places. This allowed
  for malicious placement of crafted messages. [CVE-2023-25815,
  bsc#1210686]
- Apply "CVE-2023-29007-0.patch", "CVE-2023-29007-1.patch",
  "CVE-2023-29007-2.patch", and "CVE-2023-29007-3.patch" to fix a
  security vulnerability that occurred when renaming or deleting a
  section from a configuration file, then certain malicious
  configuration values might have been misinterpreted as the
  beginning of a new configuration section, leading to arbitrary
  configuration injection. [CVE-2023-29007, bsc#1210686]</changelog>
  <changelog author="msuchanek@suse.com" date="1695384000">- Downgrade openssh dependency to recommends (bsc#1215533)</changelog>
</package>
<package pkgid="a6bcff0fe835d8dc7db56371c2ce3400ad915c48d725f630068ca3e3f3c49fb7" name="python-jmespath" arch="src">
  <version epoch="0" ver="0.9.3" rel="150000.3.5.1"/>
  <changelog author="rschweikert@suse.com" date="1390046400">- Initial build</changelog>
  <changelog author="rschweikert@suse.com" date="1414065600">- Update to version 0.4.1
  + No upstream changelog</changelog>
  <changelog author="rschweikert@suse.com" date="1421582400">- Update to version 0.5.0
  + No upstream changelog
  + Update in support for fix of bnc#905354</changelog>
  <changelog author="aboe76@gmail.com" date="1427371200">- Updated to version 0.6.1
  + No Upstream Changelog</changelog>
  <changelog author="benoit.monin@gmx.fr" date="1430049600">- update to version 0.7.0:
  * Add support for JEP-12, raw string literals
  * Support .whl files
- additional changes from version 0.6.2:
  * Implement JEP-10, slice projections
  * Fix bug with filter projection parsing
  * Add to_array function
  * Add merge function
  * Fix error messages for function argument type errors
- point source URL to pypi</changelog>
  <changelog author="rjschwei@suse.com" date="1432728000">- Update to version 0.7.1:
  * Rename ``bin/jp`` to ``bin/jp.py``
  * Fix issue with precedence when parsing wildcard
    projections
  * Remove ordereddict and simplejson as py2.6 dependencies.
    These were never actually used in the jmespath code base,
    only in the unit tests.  Unittests requirements are handled
    via requirements26.txt.</changelog>
  <changelog author="rjschwei@suse.com" date="1453291200">- Manage the jp executable with update-alternatives now that
  python3-jmespath exists
- spec file improvements</changelog>
  <changelog author="rjschwei@suse.com" date="1453291201">- Fix build issues for SLE 11
  + More test dependencies required</changelog>
  <changelog author="toddrme2178@gmail.com" date="1454328000">- Update to version 0.9.0
  * Add support for new lines with tokens in an expression
  * Add support for JEP 9 which introduces "and" expressions, "unary"
    expressions, "not" expressions, and "paren" expressions
  * Fix issue with hardcoded path in ``jp.py`` executable
    (issue 90, issue 88, issue 82)
- Update to version 0.8.0
  * Improve lexing performance (issue 84)
  * Fix parsing error for multiselect lists (issue 86)
  * Fix issue with escaping single quotes in literal strings (issue 85)
  * Add support for providing your own dict cls to support
    ordered dictionaries (issue 94)
  * Add map() function (issue 95)</changelog>
  <changelog author="toddrme2178@gmail.com" date="1471262400">- Fix update-alternatives implementation.</changelog>
  <changelog author="rjschwei@suse.com" date="1489665600">- Switch to single-spec build
- Update to version 0.9.2
  + Fix regression when using ordering comparators on strings (issue 124)
- From 0.9.1
  + Raise LexerError on invalid numbers (issue 98)
  + Add support for custom functions (#100) (issue 100)
  + Fix ZeroDivisionError for built-in function avg() on empty lists (#115)
    (issue 115)
  + Properly handle non numerical ordering operators (#117) (issue 117)</changelog>
  <changelog author="tbechtold@suse.com" date="1490788800">- Only BuildRequire unittest2 for python2</changelog>
  <changelog author="jmatejek@suse.com" date="1490788801">- properly Requires(postun) for %postun section</changelog>
  <changelog author="rjschwei@suse.com" date="1510228800">- Update to 0.9.3:
  + Fix issue where long types in py2 and Decimal types were not
    being evaluated as numbers (issue 125)
  + Handle numbers in scientific notation in to_number() function (issue 120)
  + Fix issue where custom functions would override the function
    table of the builtin function class (issue 133)</changelog>
</package>
<package pkgid="34da21f73d3da063b0fa692437800c2da2331237cff6d75e4f46abd9463e8dcb" name="python-kiwi" arch="src">
  <version epoch="0" ver="9.24.43" rel="150100.3.62.1"/>
  <changelog author="ms@suse.de" date="1635163200">- Bump version: 9.23.20 → 9.24.2
  This version upgrade includes several fixes:
  * Fixed secure boot fallback setup
    Make sure MokManager gets copied. The name and location of
    the mok manager is distribution specific in the same way as
    the shim loader. Thus we need to apply a similar concept
    for looking it up. This Fixes bsc#1187515
  * Allow creation of LUKS system with empty key
    To support cloud platforms better we should allow the
    creation of an initial(insecure) LUKS encrypted image
    with an empty passphrase/keyfile. This Fixes
    bsc#1187461 and bsc#1187460
  * Delete obsolete ddb.adapterType patching
    When building a vmdk image with pvscsi as adapter type, kiwi
    implicitly changed the adapter_type from pvscsi to lsilogic
    because qemu only knows lsilogic. At the end kiwi patched
    the adapter type in the descriptor of the vmdk header back
    to pvscsi. That patching seems to be wrong according to
    information from users and VMware support. This commit
    deletes the descriptor patching and only leaves the pvscsi
    setting in the guest configuration(vmx).
    This Fixes bsc#1180539 and Fixes #1847
  * Make dracut version check more robust
    The check_dracut_module_versions_compatible_to_kiwi() runtime
    check calls the package manager from the host and reads the
    package database from the image root. Doing this requires
    the package database in the image to be compatible with the
    package manager on the host. However this cannot be guarenteed
    and it is more robust to chroot into the image root and call
    the package manager from there. However, this change also comes
    with the cost that it's required to have a package manager
    available in the image root tree. Therefore along with the
    chroot based call, eventual exceptions from the call are now
    catched and leads to a debug message in the log file but will
    not lead the runtime check to fail. I consider the cases
    without a package database inside of the image to be less
    critical than the incompatibility issue between the host
    tooling and the package database in the image.
    This Fixes bsc#1185937
  * Fixed setup of repository architecture
    Unfortunately the architecture reported by uname is not
    necessarily the same name as used in the repository metadata.
    Therefore it was not a good idea to set the architecture
    and manage the name via a mapping table. It also has turned
    out that repo arch names are distro specific which causes
    more complexity on an eventual mapping table. In the end
    this commit changes the way how the repository architecture
    is setup in a way that we only set the architecture if
    a name was explicitly specified such that the user keeps
    full control over it without any mapping magic included
    This Fixes bsc#1185287
  * Do not apply default subcommand for derivate containers
    This commit does not apply the default subcommand for derivate
    containers. Fixes bsc#1184823
  * Added openssl to the core requires
    openssl is used in kiwi to construct a password hash
    if the plaintext password feature for user settings
    is used. This Fixes bsc#1184128</changelog>
  <changelog author="dcassany@suse.com" date="1643630400">- Bump version: 9.24.15 → 9.24.16
  This version upgrade includes several fixes:
  * Fixed regression in compression detection
    The change from 282529de8f612dee32d54ee868c2365dcd829220
    Introduced a bad regression. The assumption was made that the
    xz tool could be used to detect if a file is compressed or not.
    However, this requires the file to be locally present. In the
    scope of the method call is_compressed() and within a remote
    deployment e.g PXE this is not the case. Therefore the former
    way to "detect" the compression according to the .xz postfix
    of the source filename was restored. In addition the function
    name was changed to is_xz_compressed() because that's what the
    method can do and not more. This Fixes #2015
    Fixes a regression in the scope of bsc#1192975 (#c16)
  * index.rst: Change title (bsc#1189294#c2)
  * 'KIWI NG 9: KIWI NG Documentation' -&gt; 'Building Linux System Appliances with KIWI Next Generation (KIWI NG &lt;VERSION&gt;)
  * suggested in bsc#1189294#c2 for more clarity
  * change has been discussed with and approved by main author (Marcus S.)
  * Care for different snapper template locations
    snapper recently changed their config template location
    from etc/ to usr/. This commit handles the two locations
    and Fixes bsc#1192940
  * Do not force dracut into a compression setting
    So far we called dracut with --xz which forces the initrd
    to be xz compressed. There are other compression formats
    used by the distributions and they might differe from xz.
    The selection for a compression tool is done by a dist
    configuration in dracut.conf.d which is provided by the
    distributions as they see fit. For us this means not
    forcing dracut into a specific compression setting allows
    to make use of the distro provided setting and also
    allows to change/override this setting by an overlay
    file. This Fixes bsc#1192975</changelog>
  <changelog author="dcassany@suse.com" date="1643630401">- Ensure backward compatibility on deprecated methods
  This commit ensures backward compatibility for deprecated
  config bash script utilities.
  Fixes bsc#1195229
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="fvogt@suse.de" date="1646222400">- Don't exit the script on deprecated function use (bsc#1196644)
  The "exit 0" there stops processing of the calling script with a success exit
  code, which leads to incomplete and broken images.</changelog>
  <changelog author="dcassany@suse.com" date="1646222401">- Stick to pytest v6.x.y
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1648555200">- Bump version: 9.24.16 → 9.24.17
  This version includes fixes for:
  * Fix booting GRUB submenu entries with hybrid images (linux/linuxefi)
    Variables assigned with "set" are not visible in submenus for some reason.
    Export $linux and $initrd, so that they also work in submenu entries.
    Fixes bsc#1192523</changelog>
  <changelog author="dcassany@suse.com" date="1653307200">- Bump version up to v9.24.36
  This version includes fixes for:
  * Preserve LABEL setting (#2108)
    Preserve the LABEL= setting when the grub config file is re-generated.
    the GRUB_ENABLE_LINUX_LABEL setting does not exists upstream and
    not in any SUSE distribution. Set the grub setting such that LABEL
    is preserved on SUSE distros. (bsc#1197616)
  * Add ensure_empty_tmpdirs option for OCI containers (bsc#1197783)
    Since #1759 was merged, the contents of /run/ and /tmp/ are excluded from
    built images.  This causes problems for some containers, notably Ceph when
    deployed in a Rook/k8s environment, which needs to have certain directories
    present inside /run/.  This commit adds the ability to return to the previous
    behaviour and *not* empty those temporary directories, if you specify
    &lt;image&gt;&lt;preferences&gt;&lt;type [...] ensure_empty_tmpdirs="false"&gt;.
    Fixes: https://github.com/OSInside/kiwi/issues/2093
    Signed-off-by: Tim Serong &lt;tserong@suse.com&gt;
  * Set /.snapshots subvolume to mode 0700 (bsc#1194992)
    Avoid that users other than root can enter or even change the content.
    This is what snapper does as well.</changelog>
  <changelog author="dcassany@suse.com" date="1653393600">- Remove mailmap so email is not updated for old changelog entries in IBS
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;</changelog>
  <changelog author="dcassany@suse.com" date="1666958400">- Bump version up to 9.24.43
  This version includes:
  * Fixed error handling for setfiles policy lookup
    Errors from os.scandir were not catched. In addition the path
    to run scandir was not properly created
  * Prefer file based syscall in kexec when possible (bsc#1203896)
    Use file based syscall in kexec if available. This is needed to
    support boot on an secure boot enabled system and is in general
    more reliable to boot into the system on real hardware platforms
  * Correct setfiles relabeling
    This change was inspired by a change done on Fedora's livecd-tools
    from here: livecd-tools/livecd-tools#236. The patch corrects issues
    with the setfiles SELinux relabel command. The issues become apparent
    when the host and guest policies differ. Thus it becomes required
    to explicitly set the policy to decouple from eventual unwanted
    host settings.
  * Fix helper method to detect dracut outfile format
    The method _get_boot_image_output_file_format_from_dracut_code
    is used in kiwi to match parts of the dracut code for the used
    output file format. Beginning with dracut-056 the code part
    checked has changed syntactically such that the match did
    no longer work. This commit increases the scope of the match
    and replace pattern and Fixes #2149
  * Fixed handling of signing_keys in cmdline options
    When passing signing_keys with the --add-repo|--set-repo
    commandline options the delimiter to separate the single
    key information is a colon(:). However, this is stupid when
    kiwi expects the signing key to be references as an URI
    format like file://... Therefore this patch changes the
    delimiter from colon(:) to semicolon(;)
  * Setup SELinux on every system prepare / build (#2148)
    Setup SELinux on every system prepare / build such that all image
    types benefit from it not only the disk (oem) type
  * Install all of QEMU to Ubuntu arm integration test
  * rename user to ubuntu for Ubuntu integration test
  * Move to sphinx&gt;=5.0.0
  * Fixed sphinx extlinks rendering
    In Sphinx v5 warning will be treated as errors. This results in the following
    warning to be an error: extlinks: Sphinx-6.0 will require a caption string to
    contain exactly one '%s' and all other '%' need to be escaped as '%%'.
    This commit applies the required quoting
  * Added example aarch64 integration test for Ubuntu
    Created a RaspberryPI image description for Ubuntu(jammy)
    as integration test for building aarch64 images and added
    it to the integration test matrix
  * Added --target-arch for image info
    Allow cross arch dependency solving
  * Add support for group id in users setting
    Allow to specify the group id in the groups list a user
    should belong to. The group id can be placed as part of
    the group name separated by a colon like in the following
    example:
    &lt;users&gt;
    &lt;user groups="kiwi,admin:42,users" password="..." name="kiwi"/&gt;
    &lt;/users&gt;
    Please note kiwi checks if the provided group already
    exists and only creates a group if it is not already present in
    the system. As default groups are usually provided by the OS
    itself including its preferred group id, you will intentionally
    not be able to overwrite group id for existing groups.
    This Fixes #2064</changelog>
  <changelog author="dcassany@suse.com" date="1666958401">- Fixed kexec options setup in kiwi-dump-reboot
  The dracut module 99kiwi-dump-reboot creates an options
  list for kexec. Under certain conditions the options
  list can contain multiple spaces which leads to an error
  when calling kexec. This commit makes sure to trim
  white spaces. This Fixes #2178
  Backported from upstream c694e25b22</changelog>
  <changelog author="dcassany@suse.com" date="1680177600">- Add parted dependency for s390
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit cc993f47cd93551ae6b87ca9ac39cb2291ab57f6)</changelog>
  <changelog author="dcassany@suse.com" date="1680523200">- Expand DASD partition table with parted
  Fixes bsc#1209247
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit b12ebcedb7cb18e05ce6a19e3312c16f5c5529a9)</changelog>
  <changelog author="dcassany@suse.com" date="1681300800">- Use parted only in s390 arch
  This commit ensures parted is only called in dracut-kiwi-lib for s390
  arch. It also fixes the spec to only require parted for
  s390 builds.
  In addition parted requirement has been removed from dracut-kiwi-live
  package since parted is not used in any other dracut module beyond
  kiwi-lib.
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 0947fce33a39eaa7c4f1f83481782c41b4e15488)</changelog>
  <changelog author="dcassany@suse.com" date="1681300801">- Adding a comment to explain the s390 specific path
  Signed-off-by: David Cassany &lt;dcassany@suse.com&gt;
  (cherry picked from commit 8b9c5d766eb2113e55132eb4b4043c960b981b90)</changelog>
  <changelog author="jesus.bv@suse.com" date="1689681600">- Add SECURE_BOOT no when the firmware is efi
  This Fixes bsc#1211102</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1690200000">- Cleanup condition for SECURE_BOOT=yes|no
  The statement serves the purpose for an if/else construction
  to become a better read. In addition delete the probably
  left-over print statement from the test</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310400">- Update CI workflows
  Update tox and workflow files to run with a newer tox version
  as it's been used upstream</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310401">- Temporary disable mypy checking
  The current code base is not mypy clean when called on newer
  versions of mypy. This will be fixed with the next full
  upstream port</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310402">- Fixed unit tests</changelog>
  <changelog author="marcus.schaefer@gmail.com" date="1693310403">- Fixed linter errors
  Fixed white space issues now reported by flake8</changelog>
</package>
<package pkgid="636fa49828f21383bce26be738b1d26168ac35b80cd0fb94dfd89212f8e230d8" name="python-ply" arch="src">
  <version epoch="0" ver="3.10" rel="150000.3.5.1"/>
  <changelog author="maw@suse.de" date="1176465600">- Initial import into the build service
- Rename ply.spec to python-ply.spec as that is what the resultant
  package is called.</changelog>
  <changelog author="maw@suse.de" date="1193140800">- Don't build as noarch.</changelog>
  <changelog author="maw@suse.de" date="1205755200">- Import into autobuild
- Add a -doc subpackage
- Add python-ply-shebangs.patch</changelog>
  <changelog author="maw@suse.de" date="1217246400">- Update to version 2.5:
  + Various bug fixes
  + Some performance improvements
  + For a blow-by-blow account of changes, see the file CHANGES
    in the package python-ply-doc.</changelog>
  <changelog author="coolo@novell.com" date="1249819200">- Use new python macros</changelog>
  <changelog author="coolo@novell.com" date="1284465600">- Update to 3.3:
  + PLY-3.3 is a minor bug fix release, it supports both Python 2
    and Python 3.
- License changed to BSD</changelog>
  <changelog author="saschpe@suse.de" date="1301400000">- Update to 3.4:
  + Minor patch to make cpp.py compatible with Python 3.
  + Fixed setup.py trove classifiers to properly list PLY as Python
    3 compatible.
- License changed to BSD3c
- Packaged more doc files
- Moved important docs (README, ..) to base package
- Fixed build for non-SUSE distros</changelog>
  <changelog author="coolo@suse.com" date="1329134400">- patch license to follow spdx.org standard</changelog>
  <changelog author="highwaystar.ru@gmail.com" date="1337947200">- python3 package added</changelog>
  <changelog author="toddrme2178@gmail.com" date="1337947201">- spec file cleanups</changelog>
  <changelog author="toddrme2178@gmail.com" date="1357128000">- Fix building on SLES</changelog>
  <changelog author="benoit.monin@gmx.fr" date="1431345600">- update to version 3.6:
  * If PLY is unable to create the 'parser.out' or 'parsetab.py'
    files due to permission issues, it now just issues a warning
    message and continues to operate
  * Fixed some issues related to use of packages and table file
    modules
- additional changes from version 3.5:
  * Added support for defaulted_states in the parser
  * Fixed debug logging in the parser
  * Added actions to be defined to character literals (Issue #32)
  * Import of the 'parsetab.py' file is now constrained to only
    consider the directory specified by the outputdir argument to
    yacc()
  * Changed default output directory to be the same as that in
    which the yacc grammar is defined
  * Changed the parsetab.py file signature slightly so that the
    parsetab won't regenerate if created on a different major
    version of Python
  * Fixed Issue #44 call_errorfunc() should return the result of
    errorfunc()
  * Support for versions of Python &lt;2.7 is officially dropped
  * Fixed bug related to calling yacc(start=...)
  * Added skipped tests for PyPy and Java
  * Added filter to make unit tests pass under 'python -3'
  * Fixed CPP_INTEGER regex in ply/cpp.py (Issue 21)
  * Fixed yacc validation bugs when from __future__ import
    unicode_literals is being used
  * Added support for Travis-CI
  * Added a .gitignore file
  * Fixed validation problems for source files that include a
    different source code encoding specifier
  * Fixed unit tests for yacc to eliminate random failures due to
    dict hash value randomization in Python 3.3
  * Fixed comment whitespace processing bugs in ply/cpp.py
  * Fixed token names in ply/ctokens.py to match rule names
  * Changes to functions available in panic mode error recover
  * Fixed some problems with line and position tracking and the use
    of error symbols
  * Change to doc string handling in lex module
  * Fixed issue #1: Fixed _tabversion. It should use __tabversion__
    instead of __version__
  * Fixed issue #8: Literals empty list causes IndexError
  * Fixed issue #12: Typo in code snippet in documentation
  * Fixed issue #10: Correctly escape t_XOREQUAL pattern.
- clean the test and example directories
- remove stray backup files in doc
- remove unneeded executable bit of testlex.py
- remove CFLAGS export: unneeded
- do not drop executable bit of everything in test since
  it contains subdirectories
- remove useless clean section
- remove README from package: not provided anymore</changelog>
  <changelog author="hpj@urpla.net" date="1444219200">- update to version 3.8:
  * Fixed issues related to Python 3.5. Patch contributed by Barry Warsaw.
- update to version 3.7
  * Fixed problems when reading table files from pickled data.
  * Fixed regression in handling of table modules if specified as module
    objects.   See https://github.com/dabeaz/ply/issues/63
- clean up spec
- add testing rig</changelog>
  <changelog author="tbechtold@suse.com" date="1472817600">- update to 3.9:
  * Exposed the parser state number as the parser.state attribute
    in productions and error functions.
  * Fixed Issue #88. Python3 compatibility with ply/cpp.
  * Fixed Issue #93. Ply can crash if SyntaxError is raised inside
    a production.   Not actually sure if the original implementation
    worked as documented at all.  Yacc has been modified to follow
    the spec as outlined in the CHANGES noted for 11/27/07 below.
  * Fixed Issue #97. Failure with code validation when the original
    source files aren't present.   Validation step now ignores
    the missing file.
  * Minor fixes to version numbers.</changelog>
  <changelog author="rjschwei@suse.com" date="1489665600">- Switch to single-spec build
- Update to 3.10
  * Changed grammar signature computation to not involve hashing
    functions. Parts are just combined into a big string.</changelog>
  <changelog author="toddrme2178@gmail.com" date="1499688000">- Fix wrong-script-interpreter rpmlint error.</changelog>
</package>
<package pkgid="882401f0d532f0d6a3ceee3d563820d4c42b8385903228426ddfa9232946e2be" name="python-urllib3" arch="src">
  <version epoch="0" ver="1.25.10" rel="150300.4.6.1"/>
  <changelog author="tchvatal@suse.com" date="1559131200">- Add more test to skip as with new openssl some behaviour changed
  and we can't rely on them anymore</changelog>
  <changelog author="tchvatal@suse.com" date="1559908800">- Skip test_source_address_error as we raise different error with
  fixes that we provide in new python2/3</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1560945600">- Fix Upgrade from Leap 42.1/42.2 by adding Obsoletes/Provides:
  python-urllib3, fixes boo#1138746</changelog>
  <changelog author="dimstar@opensuse.org" date="1561032000">- Provides/Obsoletes does not fix the issue: we have a
  directory-to-symlink switch, which cannot be handled by RPM
  internally. Assist using pre script (boo#1138715).</changelog>
  <changelog author="dimstar@opensuse.org" date="1561118400">- Fixup pre script: the migration issue happens when changing from
  python-urllib3 to python2-urllib3: the number of installed
  instances of python2-urlliib3 is at this moment 1, unlike in
  regular updates. This is due to a name change, which consists not
  of a pure package update.</changelog>
  <changelog author="tchvatal@suse.com" date="1563796800">- Use old pytest 3.x as newer do not work with this release
  * this will be fixed with next release, just spread among
    numerous fixes in the git for quick backporting</changelog>
  <changelog author="jayvdb@gmail.com" date="1568462400">- Use have/skip_python2/3 macros to allow building only one flavour</changelog>
  <changelog author="tchvatal@suse.com" date="1568980800">- Update to 1.25.5:
  * Add mitigation for BPO-37428 affecting Python &lt;3.7.4 and OpenSSL 1.1.1+ which caused certificate verification to be enabled when using cert_reqs=CERT_NONE. (Issue #1682)
  * Propagate Retry-After header settings to subsequent retries. (Pull #1607)
  * Fix edge case where Retry-After header was still respected even when explicitly opted out of. (Pull #1607)
  * Remove dependency on rfc3986 for URL parsing.
  * Fix issue where URLs containing invalid characters within Url.auth would raise an exception instead of percent-encoding those characters.
  * Add support for HTTPResponse.auto_close = False which makes HTTP responses work well with BufferedReaders and other io module features. (Pull #1652)
  * Percent-encode invalid characters in URL for HTTPConnectionPool.request() (Pull #1673)
- Drop patch urllib3-ssl-default-context.patch
- Drop patch python-urllib3-recent-date.patch the date is recent
  enough on its own</changelog>
  <changelog author="tchvatal@suse.com" date="1569585600">- Restrict the tornado dep from tom to 5 or older release as the
  6.x changed the API</changelog>
  <changelog author="tchvatal@suse.com" date="1570017600">- Updae to 1.25.6:
  * Fix issue where tilde (~) characters were incorrectly percent-encoded in the path. (Pull #1692)</changelog>
  <changelog author="rhafer@suse.de" date="1571140800">- Require a new enough release of python-six. 1.25.6 needs at least
  1.12.0 for ensure_text() and friends.</changelog>
  <changelog author="mcalabkova@suse.com" date="1581076800">- update to 1.25.8
  * Drop support for EOL Python 3.4
  * Optimize _encode_invalid_chars
  * Preserve chunked parameter on retries
  * Allow unset SERVER_SOFTWARE in App Engine
  * Fix issue where URL fragment was sent within the request target.
  * Fix issue where an empty query section in a URL would fail to parse.
  * Remove TLS 1.3 support in SecureTransport due to Apple removing support.</changelog>
  <changelog author="mcepl@suse.com" date="1587470400">- Explicitly switch off building python 2 version.</changelog>
  <changelog author="dmueller@suse.com" date="1591099200">- update to 1.25.9 (bsc#1177120, CVE-2020-26137):
  * Added ``InvalidProxyConfigurationWarning`` which is raised when
    erroneously specifying an HTTPS proxy URL. urllib3 doesn't currently
    support connecting to HTTPS proxies but will soon be able to
    and we would like users to migrate properly without much breakage.
  * Drain connection after ``PoolManager`` redirect (Pull #1817)
  * Ensure ``load_verify_locations`` raises ``SSLError`` for all backends (Pull #1812)
  * Rename ``VerifiedHTTPSConnection`` to ``HTTPSConnection`` (Pull #1805)
  * Allow the CA certificate data to be passed as a string (Pull #1804)
  * Raise ``ValueError`` if method contains control characters (Pull #1800)
  * Add ``__repr__`` to ``Timeout`` (Pull #1795)</changelog>
  <changelog author="dmueller@suse.com" date="1596542400">- update to 1.25.10:
  * Added support for ``SSLKEYLOGFILE`` environment variable for
    logging TLS session keys with use with programs like
    Wireshark for decrypting captured web traffic (Pull #1867)
  * Fixed loading of SecureTransport libraries on macOS Big Sur
    due to the new dynamic linker cache (Pull #1905)
  * Collapse chunked request bodies data and framing into one
  call to ``send()`` to reduce the number of TCP packets by 2-4x (Pull #1906)
  * Don't insert ``None`` into ``ConnectionPool`` if the pool
    was empty when requesting a connection (Pull #1866)
  * Avoid ``hasattr`` call in ``BrotliDecoder.decompress()`` (Pull #1858)</changelog>
  <changelog author="aplanas@suse.com" date="1599652800">- Generate pyc for ssl_match_hostname too</changelog>
  <changelog author="mcepl@suse.com" date="1608206400">- Add CI variable, which makes timeouts in the test suite longer
  (gh#urllib3/urllib3#2109, bsc#1176389) and
  test_timeout_errors_cause_retries should not fail.</changelog>
  <changelog author="code@bnavigator.de" date="1609502400">- Skip test for RECENT_DATE. It is a test purely for developers.
  To maintain reproducibility, keep upstreams possibly outdated
  RECENT_DATE in the source code.</changelog>
  <changelog author="johannes.grassler@suse.com" date="1623412800">- Add CVE-2021-33503.patch (bsc#1187045, CVE-2021-33503)
  * Improve performance of sub-authority splitting in URL</changelog>
  <changelog author="daniel.garcia@suse.com" date="1696852800">- Add CVE-2023-43804.patch (bsc#1215968, CVE-2023-43804)
  gh#urllib3/urllib3#3139
  * Added the Cookie header to the list of headers to strip from
    requests when redirecting to a different host. As before,
    different headers can be set via Retry.remove_headers_on_redirect.</changelog>
</package>
<package pkgid="1b45d0a2452d94cef9988e2731258d04b8deee2d00576e3c5c8ebd9f24640a21" name="python3" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.51.1"/>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
  <changelog author="daniel.garcia@suse.com" date="1694433600">- Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing
  gh#python/cpython#108310, backport from upstream patch
  gh#python/cpython#108315
  (bsc#1214692, CVE-2023-40217)</changelog>
</package>
<package pkgid="eb60d20012544afa451688d95122c4098dbd2e1663f4e4a02aca5c3721315eeb" name="python3" arch="s390x">
  <version epoch="0" ver="3.6.15" rel="150300.10.51.1"/>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
  <changelog author="daniel.garcia@suse.com" date="1694433600">- Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing
  gh#python/cpython#108310, backport from upstream patch
  gh#python/cpython#108315
  (bsc#1214692, CVE-2023-40217)</changelog>
</package>
<package pkgid="2689c2d8d0cb475d07666f9e19132b6f71deac378afcc5a56d99e9618860b177" name="python3" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.51.1"/>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
  <changelog author="daniel.garcia@suse.com" date="1694433600">- Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing
  gh#python/cpython#108310, backport from upstream patch
  gh#python/cpython#108315
  (bsc#1214692, CVE-2023-40217)</changelog>
</package>
<package pkgid="b5450f23f7948307558bd46c936a063e4b89fd79b1d2d5115dc197aec133d286" name="python3" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.51.1"/>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
  <changelog author="daniel.garcia@suse.com" date="1694433600">- Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing
  gh#python/cpython#108310, backport from upstream patch
  gh#python/cpython#108315
  (bsc#1214692, CVE-2023-40217)</changelog>
</package>
<package pkgid="d77abe50f055b5701c4be560ffaa4435ebfd51512b1dead2ca94d27653c93c8f" name="python3-base" arch="aarch64">
  <version epoch="0" ver="3.6.15" rel="150300.10.51.1"/>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
  <changelog author="daniel.garcia@suse.com" date="1694433600">- Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing
  gh#python/cpython#108310, backport from upstream patch
  gh#python/cpython#108315
  (bsc#1214692, CVE-2023-40217)</changelog>
</package>
<package pkgid="478338586276c18b6971660fb18c82c61397cc40432412bc397277bf5bccef7c" name="python3-base" arch="s390x">
  <version epoch="0" ver="3.6.15" rel="150300.10.51.1"/>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
  <changelog author="daniel.garcia@suse.com" date="1694433600">- Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing
  gh#python/cpython#108310, backport from upstream patch
  gh#python/cpython#108315
  (bsc#1214692, CVE-2023-40217)</changelog>
</package>
<package pkgid="fd1cb2e11e3e99460e422980179a7a3963002bca65976ba6e7c1cc60657287c1" name="python3-base" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="150300.10.51.1"/>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
  <changelog author="daniel.garcia@suse.com" date="1694433600">- Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing
  gh#python/cpython#108310, backport from upstream patch
  gh#python/cpython#108315
  (bsc#1214692, CVE-2023-40217)</changelog>
</package>
<package pkgid="dcf0de52680345e5537a143d421651f237fc4f124422bbee12fb46157d0d0c58" name="python3-core" arch="src">
  <version epoch="0" ver="3.6.15" rel="150300.10.51.1"/>
  <changelog author="mcepl@suse.com" date="1638187200">- Remove shebangs from from python-base libraries in _libdir
  (bsc#1193179, bsc#1192249).
- Readjust patches:
  - bpo-31046_ensurepip_honours_prefix.patch
  - decimal.patch
  - python-3.3.0b1-fix_date_time_compiler.patch</changelog>
  <changelog author="mcepl@suse.com" date="1639051200">- Don't use OpenSSL 1.1 on platforms which don't have it.</changelog>
  <changelog author="mcepl@suse.com" date="1639656000">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1639656001">- Don't use appstream-glib on SLE-12.
- Use Python 2-based Sphinx on SLE-12.
- No documentation on SLE-12.
- Add skip_SSL_tests.patch skipping tests because of patched
  OpenSSL (bpo#9425).</changelog>
  <changelog author="mcepl@suse.com" date="1643976000">- Rename 22198.patch into more descriptive remove-sphinx40-warning.patch.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1645531200">- Add patch support-expat-245.patch:
  * Support Expat &gt;= 2.4.5</changelog>
  <changelog author="mcepl@suse.com" date="1645876800">- Update bundled pip wheel to the latest SLE version patched
  against bsc#1186819 (CVE-2021-3572).</changelog>
  <changelog author="mcepl@suse.com" date="1654776000">- Add CVE-2015-20107-mailcap-unsafe-filenames.patch to avoid
  CVE-2015-20107 (bsc#1198511, gh#python/cpython#68966), the
  command injection in the mailcap module.
- Rename support-expat-245.patch to
  support-expat-CVE-2022-25236-patched.patch to unify the patch
  with other packages.
- Add bpo-46623-skip-zlib-s390x.patch skipping two failing tests
  on s390x.</changelog>
  <changelog author="steven.kowalik@suse.com" date="1662033600">- Add patch CVE-2021-28861-double-slash-path.patch:
  * http.server: Fix an open redirection vulnerability in the HTTP server
    when an URI path starts with //. (bsc#1202624, CVE-2021-28861)</changelog>
  <changelog author="mcepl@suse.com" date="1663329600">- Add CVE-2020-10735-DoS-no-limit-int-size.patch to fix
  CVE-2020-10735 (bsc#1203125) to limit amount of digits
  converting text to int and vice vera (potential for DoS).
  Originally by Victor Stinner of Red Hat.</changelog>
  <changelog author="mcepl@suse.com" date="1666958400">- Add CVE-2022-37454-sha3-buffer-overflow.patch to fix
  bsc#1204577 (CVE-2022-37454, gh#python/cpython#98517) buffer
  overflow in hashlib.sha3_* implementations (originally from the
  XKCP library).</changelog>
  <changelog author="mcepl@suse.com" date="1667995200">- Add CVE-2022-45061-DoS-by-IDNA-decode.patch to avoid
  CVE-2022-45061 (bsc#1205244) allowing DoS by IDNA decoding
  extremely long domain names.</changelog>
  <changelog author="mcepl@suse.com" date="1668686400">- Add bsc1188607-pythreadstate_clear-decref.patch to fix crash in
  the garbage collection (bsc#1188607).</changelog>
  <changelog author="mcepl@suse.com" date="1677067200">- Add bpo27321-email-no-replace-header.patch to stop
  email.generator.py from replacing a non-existent header
  (bsc#1208443, gh#python/cpython#71508).</changelog>
  <changelog author="mcepl@suse.com" date="1677672000">- Add CVE-2023-24329-blank-URL-bypass.patch (CVE-2023-24329,
  bsc#1208471) blocklists bypass via the urllib.parse component
  when supplying a URL that starts with blank characters</changelog>
  <changelog author="mcepl@suse.com" date="1678881600">- Add bpo-44434-libgcc_s-for-pthread_cancel.patch
  which eliminates unnecessary and dangerous calls to
  PyThread_exit_thread() (bsc#1203355).</changelog>
  <changelog author="steven.kowalik@suse.com" date="1681819200">- Use python3 modules to build the documentation.</changelog>
  <changelog author="mcepl@suse.com" date="1683115200">- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
  CVE-2007-4559 (bsc#1203750) by adding the filter for
  tarfile.extractall (PEP 706).</changelog>
  <changelog author="mcepl@suse.com" date="1683374400">- Add 99366-patch.dict-can-decorate-async.patch fixing
  gh#python/cpython#98086 (backport from Python 3.10 patch in
  gh#python/cpython!99366), fixing bsc#1211158.</changelog>
  <changelog author="daniel.garcia@suse.com" date="1694433600">- Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing
  gh#python/cpython#108310, backport from upstream patch
  gh#python/cpython#108315
  (bsc#1214692, CVE-2023-40217)</changelog>
</package>
<package pkgid="aa91871a5ac77428fe8ef71773e2f17a39762ffc9ef7b78668dc936d8dfa8a54" name="python3-cryptography" arch="aarch64">
  <version epoch="0" ver="3.3.2" rel="150400.20.3"/>
  <changelog author="tchvatal@suse.com" date="1534852800">- Update to 2.3.1:
  * updated tests for upstream wycheproof changes
  * many other tiny test tweaks</changelog>
  <changelog author="tchvatal@suse.com" date="1544097600">- Fix fdupes call</changelog>
  <changelog author="mcepl@suse.com" date="1544097601">- Update to 2.4.1:
  * Dropped support for LibreSSL 2.4.x.
  * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no
    longer supported by the OpenSSL project. At this time there
    is no time table for dropping support, however we strongly
    encourage all users to upgrade or install cryptography from
    a wheel.
  * Added initial :doc:`OCSP &lt;/x509/ocsp&gt;` support.
  * Added support for cryptography.x509.PrecertPoison.</changelog>
  <changelog author="mpluskal@suse.com" date="1546516800">- Update to version 2.4.2:
  * Updated Windows, macOS, and manylinux1 wheels to be compiled
    with OpenSSL 1.1.0j.</changelog>
  <changelog author="michael@stroeder.com" date="1548417600">- Dependency on python-idna changed to "Recommends" aligned with
  change in upstream source (see below)
- update to 2.5:
  * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1,
    but this version removes the default idna dependency as well. If you still
    need this deprecated path please install cryptography with the idna extra:
    pip install cryptography[idna].
  * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4.
  * Numerous classes and functions have been updated to allow bytes-like
    types for keying material and passwords, including symmetric algorithms,
    AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a.
  * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1.
  * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1.
  * Added support for X448 key exchange when using OpenSSL 1.1.1.
  * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1.
  * Added initial support for parsing PKCS12 files with load_key_and_certificates().
  * Added support for IssuingDistributionPoint.
  * Added rfc4514_string() method to x509.Name,
    x509.RelativeDistinguishedName, and x509.NameAttribute to format the name
    or component an RFC 4514 Distinguished Name string.
  * Added from_encoded_point(), which immediately checks if the point is on
    the curve and supports compressed points. Deprecated the previous method
    from_encoded_point().
  * Added signature_hash_algorithm to OCSPResponse.
  * Updated X25519 key exchange support to allow additional serialization
    methods. Calling public_bytes() with no arguments has been deprecated.
  * Added support for encoding compressed and uncompressed points via
    public_bytes(). Deprecated the previous method encode_point().</changelog>
  <changelog author="michael@stroeder.com" date="1551355200">- update to 2.6.1:
  * BACKWARDS INCOMPATIBLE:
    Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature
    andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature,
    which had been deprecated for nearly 4 years. Use encode_dss_signature()
    and decode_dss_signature()instead.
  * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which
    had been deprecated for nearly 3 years. Use serial_number instead.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with
    OpenSSL 1.1.1b.
  * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer.
  * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer.
  * load_ssh_public_key() can now load ed25519 public keys.
  * Add support for easily mapping an object identifier to its elliptic curve
    class viaget_curve_for_oid().
  * Add support for OpenSSL when compiled with the no-engine
    (OPENSSL_NO_ENGINE) flag.</changelog>
  <changelog author="tchvatal@suse.com" date="1559131200">- Simplify the test execution to be more understandable</changelog>
  <changelog author="mimi.vx@gmail.com" date="1559563200">- update to 2.7
  * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface.
  The CMAC and HMAC APIs have not changed, but they are no longer registered
  as MACContext instances.
  * Removed support for running our tests with setup.py test.
  * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305`
  when using OpenSSL 1.1.1 or newer.
  * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH
  in :meth:`Ed25519PublicKey.public_bytes &lt;cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes&gt;` .
  * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`
  and deprecate passing an Extension object.</changelog>
  <changelog author="michael@stroeder.com" date="1571313600">- update to 2.8
  * Added support for Python 3.8.
  * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations.
  * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9.
  * We now ship manylinux2010 wheels in addition to our manylinux1 wheels.
  * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder.
  * cryptography no longer depends on asn1crypto.
  * FreshestCRL is now allowed as a CertificateRevocationList extension.</changelog>
  <changelog author="michael@stroeder.com" date="1589544000">- update to 2.9.2
  * 2.9.2 - 2020-04-22
  - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15.
  * 2.9.1 - 2020-04-21
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g.
  * 2.9 - 2020-04-02
  - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to
    low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed.
    Users on older version of OpenSSL will need to upgrade.
  - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed.
  - Removed support for calling public_bytes() with no arguments, as per
    our deprecation policy. You must now pass encoding and format.
  - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string()
    returns the RDNs as required by RFC 4514.
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f.
  - Added support for parsing single_extensions in an OCSP response.
  - NameAttribute values can now be empty strings.</changelog>
  <changelog author="mimi.vx@gmail.com" date="1595937600">- update to 3.0
- refreshed disable-uneven-sizes-tests.patch and  skip_openssl_memleak_test.patch
  * Removed support for passing an Extension instance
    to from_issuer_subject_key_identifier(), as per our deprecation policy.
  * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed
  * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer.
  * RSA generate_private_key() no longer accepts public_exponent values except
    65537 and 3 (the latter for legacy purposes).
  * X.509 certificate parsing now enforces that the version field contains
    a valid value, rather than deferring this check until version is accessed.
  * Deprecated support for Python 2
  * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa
    private keys: load_ssh_private_key() for loading and OpenSSH for writing.
  * Added support for OpenSSH certificates to load_ssh_public_key().
  * Added encrypt_at_time() and decrypt_at_time() to Fernet.
  * Added support for the SubjectInformationAccess X.509 extension.
  * Added support for parsing SignedCertificateTimestamps in OCSP responses.
  * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid().
  * Added support for encoding attributes in certificate signing requests via add_attribute().
  * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL’s built-in CSPRNG
    instead of its own OS random engine because these versions of OpenSSL properly reseed on fork.
  * Added initial support for creating PKCS12 files with serialize_key_and_certificates().</changelog>
  <changelog author="dmueller@suse.com" date="1600430400">- update to 3.1:
  * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based
    :term:`U-label` parsing in various X.509 classes. This support was originally
    deprecated in version 2.1 and moved to an extra in 2.5.
  * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by
    the OpenSSL project. The next version of ``cryptography`` will drop support
    for it.
  * Deprecated support for Python 3.5. This version sees very little use and will
    be removed in the next release.
  * ``backend`` arguments to functions are no longer required and the
    default backend will automatically be selected if no ``backend`` is provided.
  * Added initial support for parsing certificates from PKCS7 files with
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates`
    and
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates`
    .
  * Calling ``update`` or ``update_into`` on
    :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data``
    longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This
    also resolves the same issue in :doc:`/fernet`.</changelog>
  <changelog author="dmueller@suse.com" date="1601294400">- update to 3.1.1:
  * wheels compiled with OpenSSL 1.1.1h.</changelog>
  <changelog author="michael@stroeder.com" date="1603713600">- update to 3.2 (bsc#1178168, CVE-2020-25659):
  * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time,
    to protect against Bleichenbacher vulnerabilities. Due to limitations imposed
    by our API, we cannot completely mitigate this vulnerability.
  * Support for OpenSSL 1.0.2 has been removed.
  * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder.
- drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists</changelog>
  <changelog author="michael@stroeder.com" date="1603886400">- update to 3.2.1:
  Disable blinding on RSA public keys to address an error with
  some versions of OpenSSL.</changelog>
  <changelog author="mcepl@suse.com" date="1607256000">- Remove unnecessary dependency virtualenv.</changelog>
  <changelog author="mrueckert@suse.de" date="1607515200">- update to 3.3.0
  - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed
    due to low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit
    to 1024-bit (8 byte to 128 byte) initialization vectors. This
    change is to conform with an upcoming OpenSSL release that will
    no longer support sizes outside this window.
  - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we
    now raise ValueError rather than UnsupportedAlgorithm when an
    unsupported cipher is used. This change is to conform with an
    upcoming OpenSSL release that will no longer distinguish
    between error types.
  - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite
    field Diffie-Hellman parameters of less than 512 bits in
    length. This change is to conform with an upcoming OpenSSL
    release that no longer supports smaller sizes. These keys were
    already wildly insecure and should not have been used in any
    application outside of testing.
  - Updated Windows, macOS, and manylinux wheels to be compiled
    with OpenSSL 1.1.1i.
  - Python 2 support is deprecated in cryptography. This is the
    last release that will support Python 2.
  - Added the recover_data_from_signature() function to
    RSAPublicKey for recovering the signed data from an RSA
    signature.</changelog>
  <changelog author="dmueller@suse.com" date="1608465600">- update to 3.3.1:
  * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use</changelog>
  <changelog author="michael@stroeder.com" date="1612699200">- update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331):
  * SECURITY ISSUE: Fixed a bug where certain sequences of update()
    calls when symmetrically encrypting very large payloads (&gt;2GB) could
    result in an integer overflow, leading to buffer overflows.
    CVE-2020-36242
  - drops CVE-2020-36242-buffer-overflow.patch on older dists</changelog>
  <changelog author="daniel.garcia@suse.com" date="1676289600">- Add patch CVE-2023-23931-dont-allow-update-into.patch (bsc#1208036, CVE-2023-23931)
  * Don't allow update_into to mutate immutable objects</changelog>
</package>
<package pkgid="82f56ba73171512dfa7b78c6f4bbd4eb740e2baf69e0a25e1703110fc62d7cda" name="python3-cryptography" arch="ppc64le">
  <version epoch="0" ver="3.3.2" rel="150400.20.3"/>
  <changelog author="tchvatal@suse.com" date="1534852800">- Update to 2.3.1:
  * updated tests for upstream wycheproof changes
  * many other tiny test tweaks</changelog>
  <changelog author="tchvatal@suse.com" date="1544097600">- Fix fdupes call</changelog>
  <changelog author="mcepl@suse.com" date="1544097601">- Update to 2.4.1:
  * Dropped support for LibreSSL 2.4.x.
  * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no
    longer supported by the OpenSSL project. At this time there
    is no time table for dropping support, however we strongly
    encourage all users to upgrade or install cryptography from
    a wheel.
  * Added initial :doc:`OCSP &lt;/x509/ocsp&gt;` support.
  * Added support for cryptography.x509.PrecertPoison.</changelog>
  <changelog author="mpluskal@suse.com" date="1546516800">- Update to version 2.4.2:
  * Updated Windows, macOS, and manylinux1 wheels to be compiled
    with OpenSSL 1.1.0j.</changelog>
  <changelog author="michael@stroeder.com" date="1548417600">- Dependency on python-idna changed to "Recommends" aligned with
  change in upstream source (see below)
- update to 2.5:
  * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1,
    but this version removes the default idna dependency as well. If you still
    need this deprecated path please install cryptography with the idna extra:
    pip install cryptography[idna].
  * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4.
  * Numerous classes and functions have been updated to allow bytes-like
    types for keying material and passwords, including symmetric algorithms,
    AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a.
  * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1.
  * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1.
  * Added support for X448 key exchange when using OpenSSL 1.1.1.
  * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1.
  * Added initial support for parsing PKCS12 files with load_key_and_certificates().
  * Added support for IssuingDistributionPoint.
  * Added rfc4514_string() method to x509.Name,
    x509.RelativeDistinguishedName, and x509.NameAttribute to format the name
    or component an RFC 4514 Distinguished Name string.
  * Added from_encoded_point(), which immediately checks if the point is on
    the curve and supports compressed points. Deprecated the previous method
    from_encoded_point().
  * Added signature_hash_algorithm to OCSPResponse.
  * Updated X25519 key exchange support to allow additional serialization
    methods. Calling public_bytes() with no arguments has been deprecated.
  * Added support for encoding compressed and uncompressed points via
    public_bytes(). Deprecated the previous method encode_point().</changelog>
  <changelog author="michael@stroeder.com" date="1551355200">- update to 2.6.1:
  * BACKWARDS INCOMPATIBLE:
    Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature
    andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature,
    which had been deprecated for nearly 4 years. Use encode_dss_signature()
    and decode_dss_signature()instead.
  * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which
    had been deprecated for nearly 3 years. Use serial_number instead.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with
    OpenSSL 1.1.1b.
  * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer.
  * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer.
  * load_ssh_public_key() can now load ed25519 public keys.
  * Add support for easily mapping an object identifier to its elliptic curve
    class viaget_curve_for_oid().
  * Add support for OpenSSL when compiled with the no-engine
    (OPENSSL_NO_ENGINE) flag.</changelog>
  <changelog author="tchvatal@suse.com" date="1559131200">- Simplify the test execution to be more understandable</changelog>
  <changelog author="mimi.vx@gmail.com" date="1559563200">- update to 2.7
  * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface.
  The CMAC and HMAC APIs have not changed, but they are no longer registered
  as MACContext instances.
  * Removed support for running our tests with setup.py test.
  * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305`
  when using OpenSSL 1.1.1 or newer.
  * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH
  in :meth:`Ed25519PublicKey.public_bytes &lt;cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes&gt;` .
  * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`
  and deprecate passing an Extension object.</changelog>
  <changelog author="michael@stroeder.com" date="1571313600">- update to 2.8
  * Added support for Python 3.8.
  * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations.
  * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9.
  * We now ship manylinux2010 wheels in addition to our manylinux1 wheels.
  * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder.
  * cryptography no longer depends on asn1crypto.
  * FreshestCRL is now allowed as a CertificateRevocationList extension.</changelog>
  <changelog author="michael@stroeder.com" date="1589544000">- update to 2.9.2
  * 2.9.2 - 2020-04-22
  - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15.
  * 2.9.1 - 2020-04-21
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g.
  * 2.9 - 2020-04-02
  - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to
    low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed.
    Users on older version of OpenSSL will need to upgrade.
  - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed.
  - Removed support for calling public_bytes() with no arguments, as per
    our deprecation policy. You must now pass encoding and format.
  - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string()
    returns the RDNs as required by RFC 4514.
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f.
  - Added support for parsing single_extensions in an OCSP response.
  - NameAttribute values can now be empty strings.</changelog>
  <changelog author="mimi.vx@gmail.com" date="1595937600">- update to 3.0
- refreshed disable-uneven-sizes-tests.patch and  skip_openssl_memleak_test.patch
  * Removed support for passing an Extension instance
    to from_issuer_subject_key_identifier(), as per our deprecation policy.
  * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed
  * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer.
  * RSA generate_private_key() no longer accepts public_exponent values except
    65537 and 3 (the latter for legacy purposes).
  * X.509 certificate parsing now enforces that the version field contains
    a valid value, rather than deferring this check until version is accessed.
  * Deprecated support for Python 2
  * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa
    private keys: load_ssh_private_key() for loading and OpenSSH for writing.
  * Added support for OpenSSH certificates to load_ssh_public_key().
  * Added encrypt_at_time() and decrypt_at_time() to Fernet.
  * Added support for the SubjectInformationAccess X.509 extension.
  * Added support for parsing SignedCertificateTimestamps in OCSP responses.
  * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid().
  * Added support for encoding attributes in certificate signing requests via add_attribute().
  * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL’s built-in CSPRNG
    instead of its own OS random engine because these versions of OpenSSL properly reseed on fork.
  * Added initial support for creating PKCS12 files with serialize_key_and_certificates().</changelog>
  <changelog author="dmueller@suse.com" date="1600430400">- update to 3.1:
  * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based
    :term:`U-label` parsing in various X.509 classes. This support was originally
    deprecated in version 2.1 and moved to an extra in 2.5.
  * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by
    the OpenSSL project. The next version of ``cryptography`` will drop support
    for it.
  * Deprecated support for Python 3.5. This version sees very little use and will
    be removed in the next release.
  * ``backend`` arguments to functions are no longer required and the
    default backend will automatically be selected if no ``backend`` is provided.
  * Added initial support for parsing certificates from PKCS7 files with
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates`
    and
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates`
    .
  * Calling ``update`` or ``update_into`` on
    :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data``
    longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This
    also resolves the same issue in :doc:`/fernet`.</changelog>
  <changelog author="dmueller@suse.com" date="1601294400">- update to 3.1.1:
  * wheels compiled with OpenSSL 1.1.1h.</changelog>
  <changelog author="michael@stroeder.com" date="1603713600">- update to 3.2 (bsc#1178168, CVE-2020-25659):
  * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time,
    to protect against Bleichenbacher vulnerabilities. Due to limitations imposed
    by our API, we cannot completely mitigate this vulnerability.
  * Support for OpenSSL 1.0.2 has been removed.
  * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder.
- drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists</changelog>
  <changelog author="michael@stroeder.com" date="1603886400">- update to 3.2.1:
  Disable blinding on RSA public keys to address an error with
  some versions of OpenSSL.</changelog>
  <changelog author="mcepl@suse.com" date="1607256000">- Remove unnecessary dependency virtualenv.</changelog>
  <changelog author="mrueckert@suse.de" date="1607515200">- update to 3.3.0
  - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed
    due to low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit
    to 1024-bit (8 byte to 128 byte) initialization vectors. This
    change is to conform with an upcoming OpenSSL release that will
    no longer support sizes outside this window.
  - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we
    now raise ValueError rather than UnsupportedAlgorithm when an
    unsupported cipher is used. This change is to conform with an
    upcoming OpenSSL release that will no longer distinguish
    between error types.
  - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite
    field Diffie-Hellman parameters of less than 512 bits in
    length. This change is to conform with an upcoming OpenSSL
    release that no longer supports smaller sizes. These keys were
    already wildly insecure and should not have been used in any
    application outside of testing.
  - Updated Windows, macOS, and manylinux wheels to be compiled
    with OpenSSL 1.1.1i.
  - Python 2 support is deprecated in cryptography. This is the
    last release that will support Python 2.
  - Added the recover_data_from_signature() function to
    RSAPublicKey for recovering the signed data from an RSA
    signature.</changelog>
  <changelog author="dmueller@suse.com" date="1608465600">- update to 3.3.1:
  * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use</changelog>
  <changelog author="michael@stroeder.com" date="1612699200">- update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331):
  * SECURITY ISSUE: Fixed a bug where certain sequences of update()
    calls when symmetrically encrypting very large payloads (&gt;2GB) could
    result in an integer overflow, leading to buffer overflows.
    CVE-2020-36242
  - drops CVE-2020-36242-buffer-overflow.patch on older dists</changelog>
  <changelog author="daniel.garcia@suse.com" date="1676289600">- Add patch CVE-2023-23931-dont-allow-update-into.patch (bsc#1208036, CVE-2023-23931)
  * Don't allow update_into to mutate immutable objects</changelog>
</package>
<package pkgid="958f253ca0f9a3b9604cb9922194323afdedd8c5e93bd6d2ce00aadcb3811e46" name="python3-cryptography" arch="s390x">
  <version epoch="0" ver="3.3.2" rel="150400.20.3"/>
  <changelog author="tchvatal@suse.com" date="1534852800">- Update to 2.3.1:
  * updated tests for upstream wycheproof changes
  * many other tiny test tweaks</changelog>
  <changelog author="tchvatal@suse.com" date="1544097600">- Fix fdupes call</changelog>
  <changelog author="mcepl@suse.com" date="1544097601">- Update to 2.4.1:
  * Dropped support for LibreSSL 2.4.x.
  * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no
    longer supported by the OpenSSL project. At this time there
    is no time table for dropping support, however we strongly
    encourage all users to upgrade or install cryptography from
    a wheel.
  * Added initial :doc:`OCSP &lt;/x509/ocsp&gt;` support.
  * Added support for cryptography.x509.PrecertPoison.</changelog>
  <changelog author="mpluskal@suse.com" date="1546516800">- Update to version 2.4.2:
  * Updated Windows, macOS, and manylinux1 wheels to be compiled
    with OpenSSL 1.1.0j.</changelog>
  <changelog author="michael@stroeder.com" date="1548417600">- Dependency on python-idna changed to "Recommends" aligned with
  change in upstream source (see below)
- update to 2.5:
  * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1,
    but this version removes the default idna dependency as well. If you still
    need this deprecated path please install cryptography with the idna extra:
    pip install cryptography[idna].
  * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4.
  * Numerous classes and functions have been updated to allow bytes-like
    types for keying material and passwords, including symmetric algorithms,
    AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a.
  * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1.
  * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1.
  * Added support for X448 key exchange when using OpenSSL 1.1.1.
  * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1.
  * Added initial support for parsing PKCS12 files with load_key_and_certificates().
  * Added support for IssuingDistributionPoint.
  * Added rfc4514_string() method to x509.Name,
    x509.RelativeDistinguishedName, and x509.NameAttribute to format the name
    or component an RFC 4514 Distinguished Name string.
  * Added from_encoded_point(), which immediately checks if the point is on
    the curve and supports compressed points. Deprecated the previous method
    from_encoded_point().
  * Added signature_hash_algorithm to OCSPResponse.
  * Updated X25519 key exchange support to allow additional serialization
    methods. Calling public_bytes() with no arguments has been deprecated.
  * Added support for encoding compressed and uncompressed points via
    public_bytes(). Deprecated the previous method encode_point().</changelog>
  <changelog author="michael@stroeder.com" date="1551355200">- update to 2.6.1:
  * BACKWARDS INCOMPATIBLE:
    Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature
    andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature,
    which had been deprecated for nearly 4 years. Use encode_dss_signature()
    and decode_dss_signature()instead.
  * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which
    had been deprecated for nearly 3 years. Use serial_number instead.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with
    OpenSSL 1.1.1b.
  * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer.
  * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer.
  * load_ssh_public_key() can now load ed25519 public keys.
  * Add support for easily mapping an object identifier to its elliptic curve
    class viaget_curve_for_oid().
  * Add support for OpenSSL when compiled with the no-engine
    (OPENSSL_NO_ENGINE) flag.</changelog>
  <changelog author="tchvatal@suse.com" date="1559131200">- Simplify the test execution to be more understandable</changelog>
  <changelog author="mimi.vx@gmail.com" date="1559563200">- update to 2.7
  * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface.
  The CMAC and HMAC APIs have not changed, but they are no longer registered
  as MACContext instances.
  * Removed support for running our tests with setup.py test.
  * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305`
  when using OpenSSL 1.1.1 or newer.
  * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH
  in :meth:`Ed25519PublicKey.public_bytes &lt;cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes&gt;` .
  * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`
  and deprecate passing an Extension object.</changelog>
  <changelog author="michael@stroeder.com" date="1571313600">- update to 2.8
  * Added support for Python 3.8.
  * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations.
  * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9.
  * We now ship manylinux2010 wheels in addition to our manylinux1 wheels.
  * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder.
  * cryptography no longer depends on asn1crypto.
  * FreshestCRL is now allowed as a CertificateRevocationList extension.</changelog>
  <changelog author="michael@stroeder.com" date="1589544000">- update to 2.9.2
  * 2.9.2 - 2020-04-22
  - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15.
  * 2.9.1 - 2020-04-21
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g.
  * 2.9 - 2020-04-02
  - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to
    low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed.
    Users on older version of OpenSSL will need to upgrade.
  - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed.
  - Removed support for calling public_bytes() with no arguments, as per
    our deprecation policy. You must now pass encoding and format.
  - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string()
    returns the RDNs as required by RFC 4514.
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f.
  - Added support for parsing single_extensions in an OCSP response.
  - NameAttribute values can now be empty strings.</changelog>
  <changelog author="mimi.vx@gmail.com" date="1595937600">- update to 3.0
- refreshed disable-uneven-sizes-tests.patch and  skip_openssl_memleak_test.patch
  * Removed support for passing an Extension instance
    to from_issuer_subject_key_identifier(), as per our deprecation policy.
  * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed
  * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer.
  * RSA generate_private_key() no longer accepts public_exponent values except
    65537 and 3 (the latter for legacy purposes).
  * X.509 certificate parsing now enforces that the version field contains
    a valid value, rather than deferring this check until version is accessed.
  * Deprecated support for Python 2
  * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa
    private keys: load_ssh_private_key() for loading and OpenSSH for writing.
  * Added support for OpenSSH certificates to load_ssh_public_key().
  * Added encrypt_at_time() and decrypt_at_time() to Fernet.
  * Added support for the SubjectInformationAccess X.509 extension.
  * Added support for parsing SignedCertificateTimestamps in OCSP responses.
  * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid().
  * Added support for encoding attributes in certificate signing requests via add_attribute().
  * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL’s built-in CSPRNG
    instead of its own OS random engine because these versions of OpenSSL properly reseed on fork.
  * Added initial support for creating PKCS12 files with serialize_key_and_certificates().</changelog>
  <changelog author="dmueller@suse.com" date="1600430400">- update to 3.1:
  * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based
    :term:`U-label` parsing in various X.509 classes. This support was originally
    deprecated in version 2.1 and moved to an extra in 2.5.
  * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by
    the OpenSSL project. The next version of ``cryptography`` will drop support
    for it.
  * Deprecated support for Python 3.5. This version sees very little use and will
    be removed in the next release.
  * ``backend`` arguments to functions are no longer required and the
    default backend will automatically be selected if no ``backend`` is provided.
  * Added initial support for parsing certificates from PKCS7 files with
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates`
    and
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates`
    .
  * Calling ``update`` or ``update_into`` on
    :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data``
    longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This
    also resolves the same issue in :doc:`/fernet`.</changelog>
  <changelog author="dmueller@suse.com" date="1601294400">- update to 3.1.1:
  * wheels compiled with OpenSSL 1.1.1h.</changelog>
  <changelog author="michael@stroeder.com" date="1603713600">- update to 3.2 (bsc#1178168, CVE-2020-25659):
  * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time,
    to protect against Bleichenbacher vulnerabilities. Due to limitations imposed
    by our API, we cannot completely mitigate this vulnerability.
  * Support for OpenSSL 1.0.2 has been removed.
  * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder.
- drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists</changelog>
  <changelog author="michael@stroeder.com" date="1603886400">- update to 3.2.1:
  Disable blinding on RSA public keys to address an error with
  some versions of OpenSSL.</changelog>
  <changelog author="mcepl@suse.com" date="1607256000">- Remove unnecessary dependency virtualenv.</changelog>
  <changelog author="mrueckert@suse.de" date="1607515200">- update to 3.3.0
  - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed
    due to low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit
    to 1024-bit (8 byte to 128 byte) initialization vectors. This
    change is to conform with an upcoming OpenSSL release that will
    no longer support sizes outside this window.
  - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we
    now raise ValueError rather than UnsupportedAlgorithm when an
    unsupported cipher is used. This change is to conform with an
    upcoming OpenSSL release that will no longer distinguish
    between error types.
  - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite
    field Diffie-Hellman parameters of less than 512 bits in
    length. This change is to conform with an upcoming OpenSSL
    release that no longer supports smaller sizes. These keys were
    already wildly insecure and should not have been used in any
    application outside of testing.
  - Updated Windows, macOS, and manylinux wheels to be compiled
    with OpenSSL 1.1.1i.
  - Python 2 support is deprecated in cryptography. This is the
    last release that will support Python 2.
  - Added the recover_data_from_signature() function to
    RSAPublicKey for recovering the signed data from an RSA
    signature.</changelog>
  <changelog author="dmueller@suse.com" date="1608465600">- update to 3.3.1:
  * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use</changelog>
  <changelog author="michael@stroeder.com" date="1612699200">- update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331):
  * SECURITY ISSUE: Fixed a bug where certain sequences of update()
    calls when symmetrically encrypting very large payloads (&gt;2GB) could
    result in an integer overflow, leading to buffer overflows.
    CVE-2020-36242
  - drops CVE-2020-36242-buffer-overflow.patch on older dists</changelog>
  <changelog author="daniel.garcia@suse.com" date="1676289600">- Add patch CVE-2023-23931-dont-allow-update-into.patch (bsc#1208036, CVE-2023-23931)
  * Don't allow update_into to mutate immutable objects</changelog>
</package>
<package pkgid="1163cf320b2838ea9802aa8f08ddf00ee15013045cd79bb7ffd66784b20c7947" name="python3-cryptography" arch="src">
  <version epoch="0" ver="3.3.2" rel="150400.20.3"/>
  <changelog author="tchvatal@suse.com" date="1534852800">- Update to 2.3.1:
  * updated tests for upstream wycheproof changes
  * many other tiny test tweaks</changelog>
  <changelog author="tchvatal@suse.com" date="1544097600">- Fix fdupes call</changelog>
  <changelog author="mcepl@suse.com" date="1544097601">- Update to 2.4.1:
  * Dropped support for LibreSSL 2.4.x.
  * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no
    longer supported by the OpenSSL project. At this time there
    is no time table for dropping support, however we strongly
    encourage all users to upgrade or install cryptography from
    a wheel.
  * Added initial :doc:`OCSP &lt;/x509/ocsp&gt;` support.
  * Added support for cryptography.x509.PrecertPoison.</changelog>
  <changelog author="mpluskal@suse.com" date="1546516800">- Update to version 2.4.2:
  * Updated Windows, macOS, and manylinux1 wheels to be compiled
    with OpenSSL 1.1.0j.</changelog>
  <changelog author="michael@stroeder.com" date="1548417600">- Dependency on python-idna changed to "Recommends" aligned with
  change in upstream source (see below)
- update to 2.5:
  * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1,
    but this version removes the default idna dependency as well. If you still
    need this deprecated path please install cryptography with the idna extra:
    pip install cryptography[idna].
  * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4.
  * Numerous classes and functions have been updated to allow bytes-like
    types for keying material and passwords, including symmetric algorithms,
    AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a.
  * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1.
  * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1.
  * Added support for X448 key exchange when using OpenSSL 1.1.1.
  * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1.
  * Added initial support for parsing PKCS12 files with load_key_and_certificates().
  * Added support for IssuingDistributionPoint.
  * Added rfc4514_string() method to x509.Name,
    x509.RelativeDistinguishedName, and x509.NameAttribute to format the name
    or component an RFC 4514 Distinguished Name string.
  * Added from_encoded_point(), which immediately checks if the point is on
    the curve and supports compressed points. Deprecated the previous method
    from_encoded_point().
  * Added signature_hash_algorithm to OCSPResponse.
  * Updated X25519 key exchange support to allow additional serialization
    methods. Calling public_bytes() with no arguments has been deprecated.
  * Added support for encoding compressed and uncompressed points via
    public_bytes(). Deprecated the previous method encode_point().</changelog>
  <changelog author="michael@stroeder.com" date="1551355200">- update to 2.6.1:
  * BACKWARDS INCOMPATIBLE:
    Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature
    andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature,
    which had been deprecated for nearly 4 years. Use encode_dss_signature()
    and decode_dss_signature()instead.
  * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which
    had been deprecated for nearly 3 years. Use serial_number instead.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with
    OpenSSL 1.1.1b.
  * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer.
  * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer.
  * load_ssh_public_key() can now load ed25519 public keys.
  * Add support for easily mapping an object identifier to its elliptic curve
    class viaget_curve_for_oid().
  * Add support for OpenSSL when compiled with the no-engine
    (OPENSSL_NO_ENGINE) flag.</changelog>
  <changelog author="tchvatal@suse.com" date="1559131200">- Simplify the test execution to be more understandable</changelog>
  <changelog author="mimi.vx@gmail.com" date="1559563200">- update to 2.7
  * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface.
  The CMAC and HMAC APIs have not changed, but they are no longer registered
  as MACContext instances.
  * Removed support for running our tests with setup.py test.
  * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305`
  when using OpenSSL 1.1.1 or newer.
  * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH
  in :meth:`Ed25519PublicKey.public_bytes &lt;cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes&gt;` .
  * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`
  and deprecate passing an Extension object.</changelog>
  <changelog author="michael@stroeder.com" date="1571313600">- update to 2.8
  * Added support for Python 3.8.
  * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations.
  * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9.
  * We now ship manylinux2010 wheels in addition to our manylinux1 wheels.
  * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder.
  * cryptography no longer depends on asn1crypto.
  * FreshestCRL is now allowed as a CertificateRevocationList extension.</changelog>
  <changelog author="michael@stroeder.com" date="1589544000">- update to 2.9.2
  * 2.9.2 - 2020-04-22
  - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15.
  * 2.9.1 - 2020-04-21
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g.
  * 2.9 - 2020-04-02
  - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to
    low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed.
    Users on older version of OpenSSL will need to upgrade.
  - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed.
  - Removed support for calling public_bytes() with no arguments, as per
    our deprecation policy. You must now pass encoding and format.
  - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string()
    returns the RDNs as required by RFC 4514.
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f.
  - Added support for parsing single_extensions in an OCSP response.
  - NameAttribute values can now be empty strings.</changelog>
  <changelog author="mimi.vx@gmail.com" date="1595937600">- update to 3.0
- refreshed disable-uneven-sizes-tests.patch and  skip_openssl_memleak_test.patch
  * Removed support for passing an Extension instance
    to from_issuer_subject_key_identifier(), as per our deprecation policy.
  * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed
  * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer.
  * RSA generate_private_key() no longer accepts public_exponent values except
    65537 and 3 (the latter for legacy purposes).
  * X.509 certificate parsing now enforces that the version field contains
    a valid value, rather than deferring this check until version is accessed.
  * Deprecated support for Python 2
  * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa
    private keys: load_ssh_private_key() for loading and OpenSSH for writing.
  * Added support for OpenSSH certificates to load_ssh_public_key().
  * Added encrypt_at_time() and decrypt_at_time() to Fernet.
  * Added support for the SubjectInformationAccess X.509 extension.
  * Added support for parsing SignedCertificateTimestamps in OCSP responses.
  * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid().
  * Added support for encoding attributes in certificate signing requests via add_attribute().
  * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL’s built-in CSPRNG
    instead of its own OS random engine because these versions of OpenSSL properly reseed on fork.
  * Added initial support for creating PKCS12 files with serialize_key_and_certificates().</changelog>
  <changelog author="dmueller@suse.com" date="1600430400">- update to 3.1:
  * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based
    :term:`U-label` parsing in various X.509 classes. This support was originally
    deprecated in version 2.1 and moved to an extra in 2.5.
  * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by
    the OpenSSL project. The next version of ``cryptography`` will drop support
    for it.
  * Deprecated support for Python 3.5. This version sees very little use and will
    be removed in the next release.
  * ``backend`` arguments to functions are no longer required and the
    default backend will automatically be selected if no ``backend`` is provided.
  * Added initial support for parsing certificates from PKCS7 files with
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates`
    and
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates`
    .
  * Calling ``update`` or ``update_into`` on
    :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data``
    longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This
    also resolves the same issue in :doc:`/fernet`.</changelog>
  <changelog author="dmueller@suse.com" date="1601294400">- update to 3.1.1:
  * wheels compiled with OpenSSL 1.1.1h.</changelog>
  <changelog author="michael@stroeder.com" date="1603713600">- update to 3.2 (bsc#1178168, CVE-2020-25659):
  * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time,
    to protect against Bleichenbacher vulnerabilities. Due to limitations imposed
    by our API, we cannot completely mitigate this vulnerability.
  * Support for OpenSSL 1.0.2 has been removed.
  * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder.
- drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists</changelog>
  <changelog author="michael@stroeder.com" date="1603886400">- update to 3.2.1:
  Disable blinding on RSA public keys to address an error with
  some versions of OpenSSL.</changelog>
  <changelog author="mcepl@suse.com" date="1607256000">- Remove unnecessary dependency virtualenv.</changelog>
  <changelog author="mrueckert@suse.de" date="1607515200">- update to 3.3.0
  - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed
    due to low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit
    to 1024-bit (8 byte to 128 byte) initialization vectors. This
    change is to conform with an upcoming OpenSSL release that will
    no longer support sizes outside this window.
  - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we
    now raise ValueError rather than UnsupportedAlgorithm when an
    unsupported cipher is used. This change is to conform with an
    upcoming OpenSSL release that will no longer distinguish
    between error types.
  - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite
    field Diffie-Hellman parameters of less than 512 bits in
    length. This change is to conform with an upcoming OpenSSL
    release that no longer supports smaller sizes. These keys were
    already wildly insecure and should not have been used in any
    application outside of testing.
  - Updated Windows, macOS, and manylinux wheels to be compiled
    with OpenSSL 1.1.1i.
  - Python 2 support is deprecated in cryptography. This is the
    last release that will support Python 2.
  - Added the recover_data_from_signature() function to
    RSAPublicKey for recovering the signed data from an RSA
    signature.</changelog>
  <changelog author="dmueller@suse.com" date="1608465600">- update to 3.3.1:
  * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use</changelog>
  <changelog author="michael@stroeder.com" date="1612699200">- update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331):
  * SECURITY ISSUE: Fixed a bug where certain sequences of update()
    calls when symmetrically encrypting very large payloads (&gt;2GB) could
    result in an integer overflow, leading to buffer overflows.
    CVE-2020-36242
  - drops CVE-2020-36242-buffer-overflow.patch on older dists</changelog>
  <changelog author="daniel.garcia@suse.com" date="1676289600">- Add patch CVE-2023-23931-dont-allow-update-into.patch (bsc#1208036, CVE-2023-23931)
  * Don't allow update_into to mutate immutable objects</changelog>
</package>
<package pkgid="8d01db80914ea5adb8bfa4e7bd3ad7f8976aab6cc76859f1da5871870d8ca797" name="python3-cryptography" arch="x86_64">
  <version epoch="0" ver="3.3.2" rel="150400.20.3"/>
  <changelog author="tchvatal@suse.com" date="1534852800">- Update to 2.3.1:
  * updated tests for upstream wycheproof changes
  * many other tiny test tweaks</changelog>
  <changelog author="tchvatal@suse.com" date="1544097600">- Fix fdupes call</changelog>
  <changelog author="mcepl@suse.com" date="1544097601">- Update to 2.4.1:
  * Dropped support for LibreSSL 2.4.x.
  * Deprecated OpenSSL 1.0.1 support. OpenSSL 1.0.1 is no
    longer supported by the OpenSSL project. At this time there
    is no time table for dropping support, however we strongly
    encourage all users to upgrade or install cryptography from
    a wheel.
  * Added initial :doc:`OCSP &lt;/x509/ocsp&gt;` support.
  * Added support for cryptography.x509.PrecertPoison.</changelog>
  <changelog author="mpluskal@suse.com" date="1546516800">- Update to version 2.4.2:
  * Updated Windows, macOS, and manylinux1 wheels to be compiled
    with OpenSSL 1.1.0j.</changelog>
  <changelog author="michael@stroeder.com" date="1548417600">- Dependency on python-idna changed to "Recommends" aligned with
  change in upstream source (see below)
- update to 2.5:
  * BACKWARDS INCOMPATIBLE: U-label strings were deprecated in version 2.1,
    but this version removes the default idna dependency as well. If you still
    need this deprecated path please install cryptography with the idna extra:
    pip install cryptography[idna].
  * BACKWARDS INCOMPATIBLE: The minimum supported PyPy version is now 5.4.
  * Numerous classes and functions have been updated to allow bytes-like
    types for keying material and passwords, including symmetric algorithms,
    AEAD ciphers, KDFs, loading asymmetric keys, and one time password classes.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with OpenSSL 1.1.1a.
  * Added support for SHA512_224 and SHA512_256 when using OpenSSL 1.1.1.
  * Added support for SHA3_224, SHA3_256, SHA3_384, and SHA3_512 when using OpenSSL 1.1.1.
  * Added support for X448 key exchange when using OpenSSL 1.1.1.
  * Added support for SHAKE128 and SHAKE256 when using OpenSSL 1.1.1.
  * Added initial support for parsing PKCS12 files with load_key_and_certificates().
  * Added support for IssuingDistributionPoint.
  * Added rfc4514_string() method to x509.Name,
    x509.RelativeDistinguishedName, and x509.NameAttribute to format the name
    or component an RFC 4514 Distinguished Name string.
  * Added from_encoded_point(), which immediately checks if the point is on
    the curve and supports compressed points. Deprecated the previous method
    from_encoded_point().
  * Added signature_hash_algorithm to OCSPResponse.
  * Updated X25519 key exchange support to allow additional serialization
    methods. Calling public_bytes() with no arguments has been deprecated.
  * Added support for encoding compressed and uncompressed points via
    public_bytes(). Deprecated the previous method encode_point().</changelog>
  <changelog author="michael@stroeder.com" date="1551355200">- update to 2.6.1:
  * BACKWARDS INCOMPATIBLE:
    Removedcryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature
    andcryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature,
    which had been deprecated for nearly 4 years. Use encode_dss_signature()
    and decode_dss_signature()instead.
  * BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which
    had been deprecated for nearly 3 years. Use serial_number instead.
  * Updated Windows, macOS, and manylinux1 wheels to be compiled with
    OpenSSL 1.1.1b.
  * Added support for Ed448 signing when using OpenSSL 1.1.1b or newer.
  * Added support for Ed25519 signing when using OpenSSL 1.1.1b or newer.
  * load_ssh_public_key() can now load ed25519 public keys.
  * Add support for easily mapping an object identifier to its elliptic curve
    class viaget_curve_for_oid().
  * Add support for OpenSSL when compiled with the no-engine
    (OPENSSL_NO_ENGINE) flag.</changelog>
  <changelog author="tchvatal@suse.com" date="1559131200">- Simplify the test execution to be more understandable</changelog>
  <changelog author="mimi.vx@gmail.com" date="1559563200">- update to 2.7
  * BACKWARDS INCOMPATIBLE: Removed the cryptography.hazmat.primitives.mac.MACContext interface.
  The CMAC and HMAC APIs have not changed, but they are no longer registered
  as MACContext instances.
  * Removed support for running our tests with setup.py test.
  * Add support for :class:`~cryptography.hazmat.primitives.poly1305.Poly1305`
  when using OpenSSL 1.1.1 or newer.
  * Support serialization with Encoding.OpenSSH and PublicFormat.OpenSSH
  in :meth:`Ed25519PublicKey.public_bytes &lt;cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey.public_bytes&gt;` .
  * Correctly allow passing a SubjectKeyIdentifier to :meth:`~cryptography.x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier`
  and deprecate passing an Extension object.</changelog>
  <changelog author="michael@stroeder.com" date="1571313600">- update to 2.8
  * Added support for Python 3.8.
  * Added class methods Poly1305.generate_tag and Poly1305.verify_tag for Poly1305 sign and verify operations.
  * Deprecated support for OpenSSL 1.0.1. Support will be removed in cryptography 2.9.
  * We now ship manylinux2010 wheels in addition to our manylinux1 wheels.
  * Added support for ed25519 and ed448 keys in the CertificateBuilder, CertificateSigningRequestBuilder, CertificateRevocationListBuilder and OCSPResponseBuilder.
  * cryptography no longer depends on asn1crypto.
  * FreshestCRL is now allowed as a CertificateRevocationList extension.</changelog>
  <changelog author="michael@stroeder.com" date="1589544000">- update to 2.9.2
  * 2.9.2 - 2020-04-22
  - Updated the macOS wheel to fix an issue where it would not run on macOS versions older than 10.15.
  * 2.9.1 - 2020-04-21
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1g.
  * 2.9 - 2020-04-02
  - BACKWARDS INCOMPATIBLE: Support for Python 3.4 has been removed due to
    low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: Support for OpenSSL 1.0.1 has been removed.
    Users on older version of OpenSSL will need to upgrade.
  - BACKWARDS INCOMPATIBLE: Support for LibreSSL 2.6.x has been removed.
  - Removed support for calling public_bytes() with no arguments, as per
    our deprecation policy. You must now pass encoding and format.
  - BACKWARDS INCOMPATIBLE: Reversed the order in which rfc4514_string()
    returns the RDNs as required by RFC 4514.
  - Updated Windows, macOS, and manylinux wheels to be compiled with OpenSSL 1.1.1f.
  - Added support for parsing single_extensions in an OCSP response.
  - NameAttribute values can now be empty strings.</changelog>
  <changelog author="mimi.vx@gmail.com" date="1595937600">- update to 3.0
- refreshed disable-uneven-sizes-tests.patch and  skip_openssl_memleak_test.patch
  * Removed support for passing an Extension instance
    to from_issuer_subject_key_identifier(), as per our deprecation policy.
  * Support for LibreSSL 2.7.x, 2.8.x, and 2.9.0 has been removed
  * Dropped support for macOS 10.9, macOS users must upgrade to 10.10 or newer.
  * RSA generate_private_key() no longer accepts public_exponent values except
    65537 and 3 (the latter for legacy purposes).
  * X.509 certificate parsing now enforces that the version field contains
    a valid value, rather than deferring this check until version is accessed.
  * Deprecated support for Python 2
  * Added support for OpenSSH serialization format for ec, ed25519, rsa and dsa
    private keys: load_ssh_private_key() for loading and OpenSSH for writing.
  * Added support for OpenSSH certificates to load_ssh_public_key().
  * Added encrypt_at_time() and decrypt_at_time() to Fernet.
  * Added support for the SubjectInformationAccess X.509 extension.
  * Added support for parsing SignedCertificateTimestamps in OCSP responses.
  * Added support for parsing attributes in certificate signing requests via get_attribute_for_oid().
  * Added support for encoding attributes in certificate signing requests via add_attribute().
  * On OpenSSL 1.1.1d and higher cryptography now uses OpenSSL’s built-in CSPRNG
    instead of its own OS random engine because these versions of OpenSSL properly reseed on fork.
  * Added initial support for creating PKCS12 files with serialize_key_and_certificates().</changelog>
  <changelog author="dmueller@suse.com" date="1600430400">- update to 3.1:
  * **BACKWARDS INCOMPATIBLE:** Removed support for ``idna`` based
    :term:`U-label` parsing in various X.509 classes. This support was originally
    deprecated in version 2.1 and moved to an extra in 2.5.
  * Deprecated OpenSSL 1.0.2 support. OpenSSL 1.0.2 is no longer supported by
    the OpenSSL project. The next version of ``cryptography`` will drop support
    for it.
  * Deprecated support for Python 3.5. This version sees very little use and will
    be removed in the next release.
  * ``backend`` arguments to functions are no longer required and the
    default backend will automatically be selected if no ``backend`` is provided.
  * Added initial support for parsing certificates from PKCS7 files with
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates`
    and
    :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates`
    .
  * Calling ``update`` or ``update_into`` on
    :class:`~cryptography.hazmat.primitives.ciphers.CipherContext` with ``data``
    longer than 2\ :sup:`31` bytes no longer raises an ``OverflowError``. This
    also resolves the same issue in :doc:`/fernet`.</changelog>
  <changelog author="dmueller@suse.com" date="1601294400">- update to 3.1.1:
  * wheels compiled with OpenSSL 1.1.1h.</changelog>
  <changelog author="michael@stroeder.com" date="1603713600">- update to 3.2 (bsc#1178168, CVE-2020-25659):
  * CVE-2020-25659: Attempted to make RSA PKCS#1v1.5 decryption more constant time,
    to protect against Bleichenbacher vulnerabilities. Due to limitations imposed
    by our API, we cannot completely mitigate this vulnerability.
  * Support for OpenSSL 1.0.2 has been removed.
  * Added basic support for PKCS7 signing (including SMIME) via PKCS7SignatureBuilder.
- drops 5507-mitigate-Bleichenbacher-attacks.patch on older dists</changelog>
  <changelog author="michael@stroeder.com" date="1603886400">- update to 3.2.1:
  Disable blinding on RSA public keys to address an error with
  some versions of OpenSSL.</changelog>
  <changelog author="mcepl@suse.com" date="1607256000">- Remove unnecessary dependency virtualenv.</changelog>
  <changelog author="mrueckert@suse.de" date="1607515200">- update to 3.3.0
  - BACKWARDS INCOMPATIBLE: Support for Python 3.5 has been removed
    due to low usage and maintenance burden.
  - BACKWARDS INCOMPATIBLE: The GCM and AESGCM now require 64-bit
    to 1024-bit (8 byte to 128 byte) initialization vectors. This
    change is to conform with an upcoming OpenSSL release that will
    no longer support sizes outside this window.
  - BACKWARDS INCOMPATIBLE: When deserializing asymmetric keys we
    now raise ValueError rather than UnsupportedAlgorithm when an
    unsupported cipher is used. This change is to conform with an
    upcoming OpenSSL release that will no longer distinguish
    between error types.
  - BACKWARDS INCOMPATIBLE: We no longer allow loading of finite
    field Diffie-Hellman parameters of less than 512 bits in
    length. This change is to conform with an upcoming OpenSSL
    release that no longer supports smaller sizes. These keys were
    already wildly insecure and should not have been used in any
    application outside of testing.
  - Updated Windows, macOS, and manylinux wheels to be compiled
    with OpenSSL 1.1.1i.
  - Python 2 support is deprecated in cryptography. This is the
    last release that will support Python 2.
  - Added the recover_data_from_signature() function to
    RSAPublicKey for recovering the signed data from an RSA
    signature.</changelog>
  <changelog author="dmueller@suse.com" date="1608465600">- update to 3.3.1:
  * Re-added a legacy symbol causing problems for older ``pyOpenSSL`` use</changelog>
  <changelog author="michael@stroeder.com" date="1612699200">- update to 3.3.2 (bsc#1182066, CVE-2020-36242, bsc#1198331):
  * SECURITY ISSUE: Fixed a bug where certain sequences of update()
    calls when symmetrically encrypting very large payloads (&gt;2GB) could
    result in an integer overflow, leading to buffer overflows.
    CVE-2020-36242
  - drops CVE-2020-36242-buffer-overflow.patch on older dists</changelog>
  <changelog author="daniel.garcia@suse.com" date="1676289600">- Add patch CVE-2023-23931-dont-allow-update-into.patch (bsc#1208036, CVE-2023-23931)
  * Don't allow update_into to mutate immutable objects</changelog>
</package>
<package pkgid="7fd05de42c8e1af36866bc3c57ef4ed4ff341923cbca8d94d20bc3c3684aee71" name="python3-jmespath" arch="noarch">
  <version epoch="0" ver="0.9.3" rel="150000.3.5.1"/>
  <changelog author="rschweikert@suse.com" date="1414065600">- Update to version 0.4.1
  + No upstream changelog</changelog>
  <changelog author="rschweikert@suse.com" date="1421582400">- Update to version 0.5.0
  + No upstream changelog
  + Update in support for fix of bnc#905354</changelog>
  <changelog author="aboe76@gmail.com" date="1427371200">- Updated to version 0.6.1
  + No Upstream Changelog</changelog>
  <changelog author="benoit.monin@gmx.fr" date="1430049600">- update to version 0.7.0:
  * Add support for JEP-12, raw string literals
  * Support .whl files
- additional changes from version 0.6.2:
  * Implement JEP-10, slice projections
  * Fix bug with filter projection parsing
  * Add to_array function
  * Add merge function
  * Fix error messages for function argument type errors
- point source URL to pypi</changelog>
  <changelog author="rjschwei@suse.com" date="1432728000">- Update to version 0.7.1:
  * Rename ``bin/jp`` to ``bin/jp.py``
  * Fix issue with precedence when parsing wildcard
    projections
  * Remove ordereddict and simplejson as py2.6 dependencies.
    These were never actually used in the jmespath code base,
    only in the unit tests.  Unittests requirements are handled
    via requirements26.txt.</changelog>
  <changelog author="rjschwei@suse.com" date="1453291200">- Manage the jp executable with update-alternatives now that
  python3-jmespath exists
- spec file improvements</changelog>
  <changelog author="rjschwei@suse.com" date="1453291201">- Fix build issues for SLE 11
  + More test dependencies required</changelog>
  <changelog author="toddrme2178@gmail.com" date="1454328000">- Update to version 0.9.0
  * Add support for new lines with tokens in an expression
  * Add support for JEP 9 which introduces "and" expressions, "unary"
    expressions, "not" expressions, and "paren" expressions
  * Fix issue with hardcoded path in ``jp.py`` executable
    (issue 90, issue 88, issue 82)
- Update to version 0.8.0
  * Improve lexing performance (issue 84)
  * Fix parsing error for multiselect lists (issue 86)
  * Fix issue with escaping single quotes in literal strings (issue 85)
  * Add support for providing your own dict cls to support
    ordered dictionaries (issue 94)
  * Add map() function (issue 95)</changelog>
  <changelog author="toddrme2178@gmail.com" date="1471262400">- Fix update-alternatives implementation.</changelog>
  <changelog author="rjschwei@suse.com" date="1489665600">- Switch to single-spec build
- Update to version 0.9.2
  + Fix regression when using ordering comparators on strings (issue 124)
- From 0.9.1
  + Raise LexerError on invalid numbers (issue 98)
  + Add support for custom functions (#100) (issue 100)
  + Fix ZeroDivisionError for built-in function avg() on empty lists (#115)
    (issue 115)
  + Properly handle non numerical ordering operators (#117) (issue 117)</changelog>
  <changelog author="tbechtold@suse.com" date="1490788800">- Only BuildRequire unittest2 for python2</changelog>
  <changelog author="jmatejek@suse.com" date="1490788801">- properly Requires(postun) for %postun section</changelog>
  <changelog author="rjschwei@suse.com" date="1510228800">- Update to 0.9.3:
  + Fix issue where long types in py2 and Decimal types were not
    being evaluated as numbers (issue 125)
  + Handle numbers in scientific notation in to_number() function (issue 120)
  + Fix issue where custom functions would override the function
    table of the builtin function class (issue 133)</changelog>
</package>
<package pkgid="345a036ba2025bef02dadae21684b651865dd137b9eb505a1813c5572ad157cf" name="python3-libxml2" arch="aarch64">
  <version epoch="0" ver="2.10.3" rel="150500.5.8.1"/>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1622548800">- Update to version 2.9.12
  * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879),
    CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595,
    CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928)
  * Fix null deref in legacy SAX1 parser
  * Fix handling of unexpected EOF in xmlParseContent
  * Fix user-after-free
  * Validate UTF8 in xmlEncodeEntities
  * Fix memory leak in xmlParseElementMixedContentDecl
  * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin
  * Fix SEGV in xmlSAXParseFileWithData
  * Don't process siblings of root in xmlXIncludeProcess
  * Full changes: http://xmlsoft.org/news.html
- Drop upstream fixed
  * libxml2-CVE-2021-3541.patch
  * libxml2-CVE-2021-3537.patch
  * libxml2-CVE-2021-3518.patch
  * libxml2-CVE-2021-3517.patch
  * libxml2-CVE-2021-3516.patch
  * libxml2-CVE-2020-7595.patch
  * libxml2-CVE-2019-20388.patch
  * libxml2-CVE-2020-24977.patch
  * libxml2-CVE-2019-19956.patch
  * libxml2-python39.patch
  * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch
- Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch
- Drop since 2.8.0 merged fix-perl.diff
- Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Fix python-lxml regression with libxml2 2.9.12:
  * Work around lxml API abuse:
    gitlab.gnome.org/GNOME/libxml2/issues/255
- Add upstream patches:
  * libxml2-fix-lxml-corrupted-subtree-structures.patch
  * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch</changelog>
  <changelog author="mcepl@suse.com" date="1634731200">- Rewrite package to the single-spec %python_subpackage_only style and
  eliminate unnecessary multibuild.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1646740800">- Update to version 2.9.13:
  * Security fixes:
    + [CVE-2022-23308] Use-after-free of ID and IDREF attributes
    (boo#1196490);
    + Several memory leaks and another issues.
  * Many regressions fixes.
  * Numerous bug fixes, including, among many others:
    + xmllint's --maxmem option should work as expected now;
    + xmllint now returns an error if arguments are missing.
  * Numerous tests and code and fuzzing fixes and improvements.
  * Updated documentation.
- The full Libxml2 2.9.13 NEWS can be found here:
  https://download.gnome.org/sources/libxml2/2.9/\
  libxml2-2.9.13.news.
- Replace version-release macros in all 3 Obsoletes tag with
  plain 2.9.13 to avoid unwanted behaviors in the future.
- Remove dropped upstream AUTHORS file from list of files to be
  installed in the documentation location with 'cp' command.
- Update http://xmlsoft.org URL tag to Libxml2's new web home:
  https://gitlab.gnome.org/GNOME/libxml2.
- Update ftp://xmlsoft.org Source tag to Libxml2's new download
  host: https://download.gnome.org.
- Drop deprecated Python-2-related macro definitions/conditional
  statement from spec file.
- Drop merged upstream patches:
  libxml2-fix-lxml-corrupted-subtree-structures.patch;
  libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch.
- Drop libxml2.keyring source file as the new download host doesn't
  offer GPG signatures.
- Use ldconfig_scriptlets macro for post(un) handling.</changelog>
  <changelog author="dimstar@opensuse.org" date="1647604800">- Build python bindings in a 2nd run, using multibuild: otherwise,
  libxml2 requires pkgconfig(libxml-2.0) to build, causing issues
  to bootstrap.</changelog>
  <changelog author="david.anes@suse.com" date="1651492800">- Update to 2.9.14:
  * Security:
    + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
    + Fix potential double-free in xmlXPtrStringRangeFunction
    + Fix memory leak in xmlFindCharEncodingHandler
    + Normalize XPath strings in-place
    + Prevent integer-overflow in htmlSkipBlankChars() and
    xmlSkipBlankChars()
    + Fix leak of xmlElementContent
  * Bug fixes:
    + Fix parsing of subtracted regex character classes
    + Fix recursion check in xinclude.c
    + Reset last error in xmlCleanupGlobals
    + Fix certain combinations of regex range quantifiers
    + Fix range quantifier on subregex
  * Improvements:
    + Fix recovery from invalid HTML start tags
  * Build system, portability:
    + Define LFS macros before including system headers
    + Initialize XPath floating-point globals
    + configure: check for icu DEFS
    + configure.ac: produce tar.xz only (GNOME policy)
    + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
    + Fix build with older Python versions
    + Fix --without-valid build</changelog>
  <changelog author="david.anes@suse.com" date="1660824000">- Update to 2.10.0:
  * Security
    + [CVE-2022-2309] Reset nsNr in xmlCtxtReset
    + Reserve byte for NUL terminator and report errors consistently in xmlBuf and
    xmlBuffer
    + Fix missing NUL terminators in xmlBuf and xmlBuffer functions
    + Fix integer overflow in xmlBufferDump()
    + xmlBufAvail() should return length without including a byte for NUL
    terminator
    + Fix ownership of xmlNodePtr &amp; xmlAttrPtr fields in xmlSetTreeDoc()
    + Use xmlNewDocText in xmlXIncludeCopyRange
    + Fix use-after-free bugs when calling xmlTextReaderClose() before
    xmlFreeTextReader() on post-validating parser
    + Use UPDATE_COMPAT() consistently in buf.c
    + fix: xmlXPathParserContext could be double-delete in  OOM case.
  * Removals and deprecations
    + Disable XPointer location support by default
    + Remove outdated xml2Conf.sh
    + Deprecate module init and cleanup functions
    + Remove obsolete XML Software Autoupdate (XSA) file
    + Remove DOCBparser
    + Remove obsolete Python test framework
    + Remove broken VxWorks support
    + Remove broken Mac OS 9 support
    + Remove broken bakefile support
    + Remove broken Visual Studio 2010 support
    + Remove broken Windows CE support
    + Deprecate IDREF-related functions in valid.h
    + Deprecate legacy functions
    + Disable legacy support by default
    + Deprecate all functions in nanoftp.h
    + Disable FTP support by default
    + Add XML_DEPRECATED macro
    + Remove elfgcchack.h
  * Regressions
    + Skip incorrectly opened HTML comments
    + Restore behavior of htmlDocContentDumpFormatOutput()
  * Bug fixes
    + Fix memory leak with invalid XSD
    + Make XPath depth check work with recursive invocations
    + Fix memory leak in xmlLoadEntityContent error path
    + Avoid double-free if malloc fails in inputPush
    + Properly fold whitespace around the QName value when validating an XSD
    schema.
    + Add whitespace folding for some atomic data types that it's missing on.
    + Don't add IDs containing unexpanded entity references
  * Improvements
    + Avoid calling xmlSetTreeDoc
    + Simplify xmlFreeNode
    + Don't reset nsDef when changing node content
    + Fix unintended fall-through in xmlNodeAddContentLen
    + Remove unused xmlBuf functions
    + Implement xpath1() XPointer scheme
    + Add configuration flag for XPointer locations support
    + Fix compiler warnings in Python code
    + Mark more static data as `const`
    + Make xmlStaticCopyNode non-recursive
    + Clean up encoding switching code
    + Simplify recursive pthread mutex
    + Use non-recursive mutex in dict.c
    + Fix parser progress checks
    + Avoid arithmetic on freed pointers
    + Improve buffer allocation scheme
    + Remove unneeded #includes
    + Add support for some non-standard escapes in regular expressions.
    + htmlParseComment: handle abruptly-closed comments
    + Add let variable tag support
    + Add value-of tag support
    + Remove useless call to xmlRelaxNGCleanupTypes
    + Don't include ICU headers in public headers
    + Update `xmlStrlen()` to use POSIX / ISO C `strlen()`
    + Fix unused variable warnings with disabled features
    + Only warn on invalid redeclarations of predefined entities
    + Remove unneeded code in xmlreader.c
    + Rework validation context flags
  * Portability
    + Use NAN/INFINITY if available to init XPath NaN/Inf
    + Fix Python tests on macOS
    + Fix xmlCleanupThreads on Windows
    + Fix reinitialization of library on Windows
    + Don't mix declarations and code in runtest.c
    + Use portable python shebangs
    + Use critical sections as mutex on Windows
    + Don't set HAVE_WIN32_THREADS in win32config.h
    + Use stdint.h with newer MSVC
    + Remove cruft from win32config.h
    + Remove isinf/isnan emulation in win32config.h
    + Always fopen files with "rb"
    + Remove __DJGPP__ checks
    + Remove useless __CYGWIN__ checks
  * Build system
    + Don't autogenerate doc/examples/Makefile.am
    + cmake: Install libxml.m4 on UNIX-like platforms
    + cmake: Use symbol versioning on UNIX-like platforms
    + Port genUnicode.py to Python 3
    + Port gentest.py to Python 3
    + cmake: Fix build without thread support
    + cmake: Install documentation in CMAKE_INSTALL_DOCDIR
    + cmake: Remove non needed files in docs dir
    + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set
    + Move local Autoconf macros into m4 directory
    + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD
    + Update libxml-2.0-uninstalled.pc.in
    + Remove LIBS from XML_PRIVATE_LIBS
    + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS
    + Don't overlink executables
    + cmake: Adjust paths for UNIX or UNIX-like target systems
    + build: Make use of variables in libxml's pkg-config file
    + Avoid obsolescent `test -a` constructs
    + Move AM_MAINTAINER_MODE to AM section
    + configure.ac: make AM_SILENT_RULES([yes]) unconditional
    + Streamline documentation installation
    + Don't try to recreate COPYING symlink
    + Detect libm using libtool's macros
    + configure.ac: disable static libraries by default
    + python/Makefile.am: nest python docs in $(docdir)
    + python/Makefile.am: rely on global AM_INIT_AUTOMAKE
    + Makefile.am: install examples more idiomatically
    + configure.ac: remove useless AC_SUBST
    + Respect `--sysconfdir` in source files
    + Ignore configure backup file created by recent autoreconf too
    + Only install *.html and *.c example files
    + Remove --with-html-dir option
    + Rework documentation build system
    + Remove old website
    + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings
    + Update genChRanges.py
    + Update build_glob.py
    + Remove ICONV_CONST test
    + Remove obsolete AC_HEADER checks
    + Don't check for standard C89 library functions
    + Don't check for standard C89 headers
    + Remove special configuration for certain maintainers
  * Test suite, CI
    + Disable network in API tests
    + testapi: remove leading slash from "/missing.xml"
    + Build Autotools CI tests out of source tree (VPATH)
    + Add --with-minimum build to CI tests
    + Fix warnings when testing --with-minimum build
    + cmake: Run all tests when threads are disabled
    + Also build CI tests with -Werror
    + Move doc/examples tests to new test suite
    + Simplify 'make check' targets
    + Fix schemas and relaxng tests
    + Remove unused result files
    + Allow missing result files in runtest
    + Move regexp tests to runtest
    + Move SVG tests to runtest.c
    + Move testModule to new test suite
    + Move testThreads to new test suite
    + Remove major parts of old test suite
    + Make testchar return an error on failure
    + Add CI job for static build
    + python/tests: open() relative to test scripts
    + Port some test scripts to Python 3
  * Documentation
    + Improve documentation of tree manipulation API
    + Update xml2-config man page
    + Consolidate man pages
    + Rename xmlcatalog_man.xml
    + Make examples a standalone HTML page
    + Fix documentation in entities.c
    + Add note about optimization flags</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661428800">- Update to version 2.10.1:
  * Regressions: Fix xmlCtxtReadDoc with encoding
  * Bug fixes: Fix HTML parser with threads and --without-legacy
  * Build system:
    + Fix build with Python 3.10
    + cmake: Disable version script on macOS
    + Remove Makefile rule to build testapi.c
  * Documentation:
    + Switch back to HTML output for API documentation
    + Port doc/examples/index.py to Python 3
    + Fix order of exports in libxml2-api.xml
    + Remove libxml2-refs.xml</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661860800">- Update to version 2.10.2:
  * Improvements:
    + Remove set-but-unused variable in xmlXPathScanName
    + Silence -Warray-bounds warning
  * Build system
    + build: require automake-1.16.3 or later
    + Remove generated files from distribution
  * Test suite: Don't create missing.xml when running testapi
- Add configure --with-python=%{__python3} inbefore python build,
  as upstream no longer ships pre-grenerated files.
- Use sed to fix env-script-interpreter in documentation example.
- Pass with-ftp to configure, build ftp support.</changelog>
  <changelog author="pmonreal@suse.com" date="1662033600">- Build for now with --with-legacy to enable APIs that have been
  deprecated recently. (bsc#1202965)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1665748800">- Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304):
  + Security:
  - [CVE-2022-40304] Fix dict corruption caused by entity
    reference cycles
  - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE
  - Fix overflow check in SAX2.c
  + Build system: cmake: Set SOVERSION
- Rebase patches with quilt.</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
  <changelog author="daniel.garcia@suse.com" date="1681905600">- Build also for modern python version (jsc#PED-68)</changelog>
  <changelog author="david.anes@suse.com" date="1682078400">- Remove unneeded dependency (bsc#1209918).</changelog>
  <changelog author="david.anes@suse.com" date="1682078401">- Security update:
  * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings
    isn't deterministic
  - Added patch libxml2-CVE-2023-29469.patch
  * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in
    xmlSchemaFixupComplexType
  - Added patch libxml2-CVE-2023-28484-1.patch
  - Added patch libxml2-CVE-2023-28484-2.patch</changelog>
  <changelog author="david.anes@suse.com" date="1693828800">- Security update:
  * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global
    buffer overflow
  - Added file libxml2-CVE-2023-39615.patch</changelog>
</package>
<package pkgid="2b4f170cb81f8bcd601ef93e03d42bbc751f3d915622c0ff3277731b2b308a23" name="python3-libxml2" arch="s390x">
  <version epoch="0" ver="2.10.3" rel="150500.5.8.1"/>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1622548800">- Update to version 2.9.12
  * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879),
    CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595,
    CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928)
  * Fix null deref in legacy SAX1 parser
  * Fix handling of unexpected EOF in xmlParseContent
  * Fix user-after-free
  * Validate UTF8 in xmlEncodeEntities
  * Fix memory leak in xmlParseElementMixedContentDecl
  * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin
  * Fix SEGV in xmlSAXParseFileWithData
  * Don't process siblings of root in xmlXIncludeProcess
  * Full changes: http://xmlsoft.org/news.html
- Drop upstream fixed
  * libxml2-CVE-2021-3541.patch
  * libxml2-CVE-2021-3537.patch
  * libxml2-CVE-2021-3518.patch
  * libxml2-CVE-2021-3517.patch
  * libxml2-CVE-2021-3516.patch
  * libxml2-CVE-2020-7595.patch
  * libxml2-CVE-2019-20388.patch
  * libxml2-CVE-2020-24977.patch
  * libxml2-CVE-2019-19956.patch
  * libxml2-python39.patch
  * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch
- Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch
- Drop since 2.8.0 merged fix-perl.diff
- Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Fix python-lxml regression with libxml2 2.9.12:
  * Work around lxml API abuse:
    gitlab.gnome.org/GNOME/libxml2/issues/255
- Add upstream patches:
  * libxml2-fix-lxml-corrupted-subtree-structures.patch
  * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch</changelog>
  <changelog author="mcepl@suse.com" date="1634731200">- Rewrite package to the single-spec %python_subpackage_only style and
  eliminate unnecessary multibuild.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1646740800">- Update to version 2.9.13:
  * Security fixes:
    + [CVE-2022-23308] Use-after-free of ID and IDREF attributes
    (boo#1196490);
    + Several memory leaks and another issues.
  * Many regressions fixes.
  * Numerous bug fixes, including, among many others:
    + xmllint's --maxmem option should work as expected now;
    + xmllint now returns an error if arguments are missing.
  * Numerous tests and code and fuzzing fixes and improvements.
  * Updated documentation.
- The full Libxml2 2.9.13 NEWS can be found here:
  https://download.gnome.org/sources/libxml2/2.9/\
  libxml2-2.9.13.news.
- Replace version-release macros in all 3 Obsoletes tag with
  plain 2.9.13 to avoid unwanted behaviors in the future.
- Remove dropped upstream AUTHORS file from list of files to be
  installed in the documentation location with 'cp' command.
- Update http://xmlsoft.org URL tag to Libxml2's new web home:
  https://gitlab.gnome.org/GNOME/libxml2.
- Update ftp://xmlsoft.org Source tag to Libxml2's new download
  host: https://download.gnome.org.
- Drop deprecated Python-2-related macro definitions/conditional
  statement from spec file.
- Drop merged upstream patches:
  libxml2-fix-lxml-corrupted-subtree-structures.patch;
  libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch.
- Drop libxml2.keyring source file as the new download host doesn't
  offer GPG signatures.
- Use ldconfig_scriptlets macro for post(un) handling.</changelog>
  <changelog author="dimstar@opensuse.org" date="1647604800">- Build python bindings in a 2nd run, using multibuild: otherwise,
  libxml2 requires pkgconfig(libxml-2.0) to build, causing issues
  to bootstrap.</changelog>
  <changelog author="david.anes@suse.com" date="1651492800">- Update to 2.9.14:
  * Security:
    + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
    + Fix potential double-free in xmlXPtrStringRangeFunction
    + Fix memory leak in xmlFindCharEncodingHandler
    + Normalize XPath strings in-place
    + Prevent integer-overflow in htmlSkipBlankChars() and
    xmlSkipBlankChars()
    + Fix leak of xmlElementContent
  * Bug fixes:
    + Fix parsing of subtracted regex character classes
    + Fix recursion check in xinclude.c
    + Reset last error in xmlCleanupGlobals
    + Fix certain combinations of regex range quantifiers
    + Fix range quantifier on subregex
  * Improvements:
    + Fix recovery from invalid HTML start tags
  * Build system, portability:
    + Define LFS macros before including system headers
    + Initialize XPath floating-point globals
    + configure: check for icu DEFS
    + configure.ac: produce tar.xz only (GNOME policy)
    + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
    + Fix build with older Python versions
    + Fix --without-valid build</changelog>
  <changelog author="david.anes@suse.com" date="1660824000">- Update to 2.10.0:
  * Security
    + [CVE-2022-2309] Reset nsNr in xmlCtxtReset
    + Reserve byte for NUL terminator and report errors consistently in xmlBuf and
    xmlBuffer
    + Fix missing NUL terminators in xmlBuf and xmlBuffer functions
    + Fix integer overflow in xmlBufferDump()
    + xmlBufAvail() should return length without including a byte for NUL
    terminator
    + Fix ownership of xmlNodePtr &amp; xmlAttrPtr fields in xmlSetTreeDoc()
    + Use xmlNewDocText in xmlXIncludeCopyRange
    + Fix use-after-free bugs when calling xmlTextReaderClose() before
    xmlFreeTextReader() on post-validating parser
    + Use UPDATE_COMPAT() consistently in buf.c
    + fix: xmlXPathParserContext could be double-delete in  OOM case.
  * Removals and deprecations
    + Disable XPointer location support by default
    + Remove outdated xml2Conf.sh
    + Deprecate module init and cleanup functions
    + Remove obsolete XML Software Autoupdate (XSA) file
    + Remove DOCBparser
    + Remove obsolete Python test framework
    + Remove broken VxWorks support
    + Remove broken Mac OS 9 support
    + Remove broken bakefile support
    + Remove broken Visual Studio 2010 support
    + Remove broken Windows CE support
    + Deprecate IDREF-related functions in valid.h
    + Deprecate legacy functions
    + Disable legacy support by default
    + Deprecate all functions in nanoftp.h
    + Disable FTP support by default
    + Add XML_DEPRECATED macro
    + Remove elfgcchack.h
  * Regressions
    + Skip incorrectly opened HTML comments
    + Restore behavior of htmlDocContentDumpFormatOutput()
  * Bug fixes
    + Fix memory leak with invalid XSD
    + Make XPath depth check work with recursive invocations
    + Fix memory leak in xmlLoadEntityContent error path
    + Avoid double-free if malloc fails in inputPush
    + Properly fold whitespace around the QName value when validating an XSD
    schema.
    + Add whitespace folding for some atomic data types that it's missing on.
    + Don't add IDs containing unexpanded entity references
  * Improvements
    + Avoid calling xmlSetTreeDoc
    + Simplify xmlFreeNode
    + Don't reset nsDef when changing node content
    + Fix unintended fall-through in xmlNodeAddContentLen
    + Remove unused xmlBuf functions
    + Implement xpath1() XPointer scheme
    + Add configuration flag for XPointer locations support
    + Fix compiler warnings in Python code
    + Mark more static data as `const`
    + Make xmlStaticCopyNode non-recursive
    + Clean up encoding switching code
    + Simplify recursive pthread mutex
    + Use non-recursive mutex in dict.c
    + Fix parser progress checks
    + Avoid arithmetic on freed pointers
    + Improve buffer allocation scheme
    + Remove unneeded #includes
    + Add support for some non-standard escapes in regular expressions.
    + htmlParseComment: handle abruptly-closed comments
    + Add let variable tag support
    + Add value-of tag support
    + Remove useless call to xmlRelaxNGCleanupTypes
    + Don't include ICU headers in public headers
    + Update `xmlStrlen()` to use POSIX / ISO C `strlen()`
    + Fix unused variable warnings with disabled features
    + Only warn on invalid redeclarations of predefined entities
    + Remove unneeded code in xmlreader.c
    + Rework validation context flags
  * Portability
    + Use NAN/INFINITY if available to init XPath NaN/Inf
    + Fix Python tests on macOS
    + Fix xmlCleanupThreads on Windows
    + Fix reinitialization of library on Windows
    + Don't mix declarations and code in runtest.c
    + Use portable python shebangs
    + Use critical sections as mutex on Windows
    + Don't set HAVE_WIN32_THREADS in win32config.h
    + Use stdint.h with newer MSVC
    + Remove cruft from win32config.h
    + Remove isinf/isnan emulation in win32config.h
    + Always fopen files with "rb"
    + Remove __DJGPP__ checks
    + Remove useless __CYGWIN__ checks
  * Build system
    + Don't autogenerate doc/examples/Makefile.am
    + cmake: Install libxml.m4 on UNIX-like platforms
    + cmake: Use symbol versioning on UNIX-like platforms
    + Port genUnicode.py to Python 3
    + Port gentest.py to Python 3
    + cmake: Fix build without thread support
    + cmake: Install documentation in CMAKE_INSTALL_DOCDIR
    + cmake: Remove non needed files in docs dir
    + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set
    + Move local Autoconf macros into m4 directory
    + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD
    + Update libxml-2.0-uninstalled.pc.in
    + Remove LIBS from XML_PRIVATE_LIBS
    + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS
    + Don't overlink executables
    + cmake: Adjust paths for UNIX or UNIX-like target systems
    + build: Make use of variables in libxml's pkg-config file
    + Avoid obsolescent `test -a` constructs
    + Move AM_MAINTAINER_MODE to AM section
    + configure.ac: make AM_SILENT_RULES([yes]) unconditional
    + Streamline documentation installation
    + Don't try to recreate COPYING symlink
    + Detect libm using libtool's macros
    + configure.ac: disable static libraries by default
    + python/Makefile.am: nest python docs in $(docdir)
    + python/Makefile.am: rely on global AM_INIT_AUTOMAKE
    + Makefile.am: install examples more idiomatically
    + configure.ac: remove useless AC_SUBST
    + Respect `--sysconfdir` in source files
    + Ignore configure backup file created by recent autoreconf too
    + Only install *.html and *.c example files
    + Remove --with-html-dir option
    + Rework documentation build system
    + Remove old website
    + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings
    + Update genChRanges.py
    + Update build_glob.py
    + Remove ICONV_CONST test
    + Remove obsolete AC_HEADER checks
    + Don't check for standard C89 library functions
    + Don't check for standard C89 headers
    + Remove special configuration for certain maintainers
  * Test suite, CI
    + Disable network in API tests
    + testapi: remove leading slash from "/missing.xml"
    + Build Autotools CI tests out of source tree (VPATH)
    + Add --with-minimum build to CI tests
    + Fix warnings when testing --with-minimum build
    + cmake: Run all tests when threads are disabled
    + Also build CI tests with -Werror
    + Move doc/examples tests to new test suite
    + Simplify 'make check' targets
    + Fix schemas and relaxng tests
    + Remove unused result files
    + Allow missing result files in runtest
    + Move regexp tests to runtest
    + Move SVG tests to runtest.c
    + Move testModule to new test suite
    + Move testThreads to new test suite
    + Remove major parts of old test suite
    + Make testchar return an error on failure
    + Add CI job for static build
    + python/tests: open() relative to test scripts
    + Port some test scripts to Python 3
  * Documentation
    + Improve documentation of tree manipulation API
    + Update xml2-config man page
    + Consolidate man pages
    + Rename xmlcatalog_man.xml
    + Make examples a standalone HTML page
    + Fix documentation in entities.c
    + Add note about optimization flags</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661428800">- Update to version 2.10.1:
  * Regressions: Fix xmlCtxtReadDoc with encoding
  * Bug fixes: Fix HTML parser with threads and --without-legacy
  * Build system:
    + Fix build with Python 3.10
    + cmake: Disable version script on macOS
    + Remove Makefile rule to build testapi.c
  * Documentation:
    + Switch back to HTML output for API documentation
    + Port doc/examples/index.py to Python 3
    + Fix order of exports in libxml2-api.xml
    + Remove libxml2-refs.xml</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661860800">- Update to version 2.10.2:
  * Improvements:
    + Remove set-but-unused variable in xmlXPathScanName
    + Silence -Warray-bounds warning
  * Build system
    + build: require automake-1.16.3 or later
    + Remove generated files from distribution
  * Test suite: Don't create missing.xml when running testapi
- Add configure --with-python=%{__python3} inbefore python build,
  as upstream no longer ships pre-grenerated files.
- Use sed to fix env-script-interpreter in documentation example.
- Pass with-ftp to configure, build ftp support.</changelog>
  <changelog author="pmonreal@suse.com" date="1662033600">- Build for now with --with-legacy to enable APIs that have been
  deprecated recently. (bsc#1202965)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1665748800">- Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304):
  + Security:
  - [CVE-2022-40304] Fix dict corruption caused by entity
    reference cycles
  - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE
  - Fix overflow check in SAX2.c
  + Build system: cmake: Set SOVERSION
- Rebase patches with quilt.</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
  <changelog author="daniel.garcia@suse.com" date="1681905600">- Build also for modern python version (jsc#PED-68)</changelog>
  <changelog author="david.anes@suse.com" date="1682078400">- Remove unneeded dependency (bsc#1209918).</changelog>
  <changelog author="david.anes@suse.com" date="1682078401">- Security update:
  * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings
    isn't deterministic
  - Added patch libxml2-CVE-2023-29469.patch
  * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in
    xmlSchemaFixupComplexType
  - Added patch libxml2-CVE-2023-28484-1.patch
  - Added patch libxml2-CVE-2023-28484-2.patch</changelog>
  <changelog author="david.anes@suse.com" date="1693828800">- Security update:
  * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global
    buffer overflow
  - Added file libxml2-CVE-2023-39615.patch</changelog>
</package>
<package pkgid="84a246cd0f063ed51e4df8317fc286311419666e83f82b739a8d722ecdd5799f" name="python3-libxml2" arch="x86_64">
  <version epoch="0" ver="2.10.3" rel="150500.5.8.1"/>
  <changelog author="pmonreal@suse.com" date="1619611200">- Security fix: [bsc#1185410, CVE-2021-3517]
  * Fix heap-based buffer overflow in entities.c:xmlEncodeEntitiesInternal()
  * Add libxml2-CVE-2021-3517.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1619611201">- Security fix: [bsc#1185408, CVE-2021-3518]
  * Fix use-after-free in xinclude.c:xmlXIncludeDoProcess()
  * Add libxml2-CVE-2021-3518.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620648000">- Security fix: [bsc#1185698, CVE-2021-3537]
  * NULL pointer dereference in valid.c:xmlValidBuildAContentModel
  * Add libxml2-CVE-2021-3537.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621425600">- Security fix: [bsc#1186015, CVE-2021-3541]
  * Exponential entity expansion attack bypasses all existing
    protection mechanisms.
- Add libxml2-CVE-2021-3541.patch</changelog>
  <changelog author="rpm@fthiessen.de" date="1622548800">- Update to version 2.9.12
  * Fix CVE-2021-3541, CVE-2021-3537 (bsc#1185698, bsc#1185879),
    CVE-2021-3518, CVE-2021-3517, CVE-2021-3516, CVE-2020-7595,
    CVE-2019-20388, CVE-2020-24977, and CVE-2019-19956 (bsc#1159928)
  * Fix null deref in legacy SAX1 parser
  * Fix handling of unexpected EOF in xmlParseContent
  * Fix user-after-free
  * Validate UTF8 in xmlEncodeEntities
  * Fix memory leak in xmlParseElementMixedContentDecl
  * Fix integer overflow in xmlSchemaGetParticleTotalRangeMin
  * Fix SEGV in xmlSAXParseFileWithData
  * Don't process siblings of root in xmlXIncludeProcess
  * Full changes: http://xmlsoft.org/news.html
- Drop upstream fixed
  * libxml2-CVE-2021-3541.patch
  * libxml2-CVE-2021-3537.patch
  * libxml2-CVE-2021-3518.patch
  * libxml2-CVE-2021-3517.patch
  * libxml2-CVE-2021-3516.patch
  * libxml2-CVE-2020-7595.patch
  * libxml2-CVE-2019-20388.patch
  * libxml2-CVE-2020-24977.patch
  * libxml2-CVE-2019-19956.patch
  * libxml2-python39.patch
  * libxml2-Avoid-quadratic-checking-of-identity-constraints.patch
- Drop since 2.9.10 merged libxml2-xmlFreeNodeList-recursive.patch
- Drop since 2.8.0 merged fix-perl.diff
- Refresh libxml2-make-XPATH_MAX_NODESET_LENGTH-configurable.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1622548801">- Fix python-lxml regression with libxml2 2.9.12:
  * Work around lxml API abuse:
    gitlab.gnome.org/GNOME/libxml2/issues/255
- Add upstream patches:
  * libxml2-fix-lxml-corrupted-subtree-structures.patch
  * libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch</changelog>
  <changelog author="mcepl@suse.com" date="1634731200">- Rewrite package to the single-spec %python_subpackage_only style and
  eliminate unnecessary multibuild.</changelog>
  <changelog author="luc14n0@opensuse.org" date="1646740800">- Update to version 2.9.13:
  * Security fixes:
    + [CVE-2022-23308] Use-after-free of ID and IDREF attributes
    (boo#1196490);
    + Several memory leaks and another issues.
  * Many regressions fixes.
  * Numerous bug fixes, including, among many others:
    + xmllint's --maxmem option should work as expected now;
    + xmllint now returns an error if arguments are missing.
  * Numerous tests and code and fuzzing fixes and improvements.
  * Updated documentation.
- The full Libxml2 2.9.13 NEWS can be found here:
  https://download.gnome.org/sources/libxml2/2.9/\
  libxml2-2.9.13.news.
- Replace version-release macros in all 3 Obsoletes tag with
  plain 2.9.13 to avoid unwanted behaviors in the future.
- Remove dropped upstream AUTHORS file from list of files to be
  installed in the documentation location with 'cp' command.
- Update http://xmlsoft.org URL tag to Libxml2's new web home:
  https://gitlab.gnome.org/GNOME/libxml2.
- Update ftp://xmlsoft.org Source tag to Libxml2's new download
  host: https://download.gnome.org.
- Drop deprecated Python-2-related macro definitions/conditional
  statement from spec file.
- Drop merged upstream patches:
  libxml2-fix-lxml-corrupted-subtree-structures.patch;
  libxml2-fix-regression-in-xmlNodeDumpOutputInternal.patch.
- Drop libxml2.keyring source file as the new download host doesn't
  offer GPG signatures.
- Use ldconfig_scriptlets macro for post(un) handling.</changelog>
  <changelog author="dimstar@opensuse.org" date="1647604800">- Build python bindings in a 2nd run, using multibuild: otherwise,
  libxml2 requires pkgconfig(libxml-2.0) to build, causing issues
  to bootstrap.</changelog>
  <changelog author="david.anes@suse.com" date="1651492800">- Update to 2.9.14:
  * Security:
    + [CVE-2022-29824] Integer overflow in xmlBuf and xmlBuffer
    + Fix potential double-free in xmlXPtrStringRangeFunction
    + Fix memory leak in xmlFindCharEncodingHandler
    + Normalize XPath strings in-place
    + Prevent integer-overflow in htmlSkipBlankChars() and
    xmlSkipBlankChars()
    + Fix leak of xmlElementContent
  * Bug fixes:
    + Fix parsing of subtracted regex character classes
    + Fix recursion check in xinclude.c
    + Reset last error in xmlCleanupGlobals
    + Fix certain combinations of regex range quantifiers
    + Fix range quantifier on subregex
  * Improvements:
    + Fix recovery from invalid HTML start tags
  * Build system, portability:
    + Define LFS macros before including system headers
    + Initialize XPath floating-point globals
    + configure: check for icu DEFS
    + configure.ac: produce tar.xz only (GNOME policy)
    + CMakeLists.txt: Fix LIBXML_VERSION_NUMBER
    + Fix build with older Python versions
    + Fix --without-valid build</changelog>
  <changelog author="david.anes@suse.com" date="1660824000">- Update to 2.10.0:
  * Security
    + [CVE-2022-2309] Reset nsNr in xmlCtxtReset
    + Reserve byte for NUL terminator and report errors consistently in xmlBuf and
    xmlBuffer
    + Fix missing NUL terminators in xmlBuf and xmlBuffer functions
    + Fix integer overflow in xmlBufferDump()
    + xmlBufAvail() should return length without including a byte for NUL
    terminator
    + Fix ownership of xmlNodePtr &amp; xmlAttrPtr fields in xmlSetTreeDoc()
    + Use xmlNewDocText in xmlXIncludeCopyRange
    + Fix use-after-free bugs when calling xmlTextReaderClose() before
    xmlFreeTextReader() on post-validating parser
    + Use UPDATE_COMPAT() consistently in buf.c
    + fix: xmlXPathParserContext could be double-delete in  OOM case.
  * Removals and deprecations
    + Disable XPointer location support by default
    + Remove outdated xml2Conf.sh
    + Deprecate module init and cleanup functions
    + Remove obsolete XML Software Autoupdate (XSA) file
    + Remove DOCBparser
    + Remove obsolete Python test framework
    + Remove broken VxWorks support
    + Remove broken Mac OS 9 support
    + Remove broken bakefile support
    + Remove broken Visual Studio 2010 support
    + Remove broken Windows CE support
    + Deprecate IDREF-related functions in valid.h
    + Deprecate legacy functions
    + Disable legacy support by default
    + Deprecate all functions in nanoftp.h
    + Disable FTP support by default
    + Add XML_DEPRECATED macro
    + Remove elfgcchack.h
  * Regressions
    + Skip incorrectly opened HTML comments
    + Restore behavior of htmlDocContentDumpFormatOutput()
  * Bug fixes
    + Fix memory leak with invalid XSD
    + Make XPath depth check work with recursive invocations
    + Fix memory leak in xmlLoadEntityContent error path
    + Avoid double-free if malloc fails in inputPush
    + Properly fold whitespace around the QName value when validating an XSD
    schema.
    + Add whitespace folding for some atomic data types that it's missing on.
    + Don't add IDs containing unexpanded entity references
  * Improvements
    + Avoid calling xmlSetTreeDoc
    + Simplify xmlFreeNode
    + Don't reset nsDef when changing node content
    + Fix unintended fall-through in xmlNodeAddContentLen
    + Remove unused xmlBuf functions
    + Implement xpath1() XPointer scheme
    + Add configuration flag for XPointer locations support
    + Fix compiler warnings in Python code
    + Mark more static data as `const`
    + Make xmlStaticCopyNode non-recursive
    + Clean up encoding switching code
    + Simplify recursive pthread mutex
    + Use non-recursive mutex in dict.c
    + Fix parser progress checks
    + Avoid arithmetic on freed pointers
    + Improve buffer allocation scheme
    + Remove unneeded #includes
    + Add support for some non-standard escapes in regular expressions.
    + htmlParseComment: handle abruptly-closed comments
    + Add let variable tag support
    + Add value-of tag support
    + Remove useless call to xmlRelaxNGCleanupTypes
    + Don't include ICU headers in public headers
    + Update `xmlStrlen()` to use POSIX / ISO C `strlen()`
    + Fix unused variable warnings with disabled features
    + Only warn on invalid redeclarations of predefined entities
    + Remove unneeded code in xmlreader.c
    + Rework validation context flags
  * Portability
    + Use NAN/INFINITY if available to init XPath NaN/Inf
    + Fix Python tests on macOS
    + Fix xmlCleanupThreads on Windows
    + Fix reinitialization of library on Windows
    + Don't mix declarations and code in runtest.c
    + Use portable python shebangs
    + Use critical sections as mutex on Windows
    + Don't set HAVE_WIN32_THREADS in win32config.h
    + Use stdint.h with newer MSVC
    + Remove cruft from win32config.h
    + Remove isinf/isnan emulation in win32config.h
    + Always fopen files with "rb"
    + Remove __DJGPP__ checks
    + Remove useless __CYGWIN__ checks
  * Build system
    + Don't autogenerate doc/examples/Makefile.am
    + cmake: Install libxml.m4 on UNIX-like platforms
    + cmake: Use symbol versioning on UNIX-like platforms
    + Port genUnicode.py to Python 3
    + Port gentest.py to Python 3
    + cmake: Fix build without thread support
    + cmake: Install documentation in CMAKE_INSTALL_DOCDIR
    + cmake: Remove non needed files in docs dir
    + configure: move XML_PRIVATE_LIBS after WIN32_EXTRA_LIBADD is set
    + Move local Autoconf macros into m4 directory
    + Use XML_PRIVATE_LIBS in libxml2_la_LIBADD
    + Update libxml-2.0-uninstalled.pc.in
    + Remove LIBS from XML_PRIVATE_LIBS
    + Add WIN32_EXTRA_LIBADD to XML_PRIVATE_LIBS
    + Don't overlink executables
    + cmake: Adjust paths for UNIX or UNIX-like target systems
    + build: Make use of variables in libxml's pkg-config file
    + Avoid obsolescent `test -a` constructs
    + Move AM_MAINTAINER_MODE to AM section
    + configure.ac: make AM_SILENT_RULES([yes]) unconditional
    + Streamline documentation installation
    + Don't try to recreate COPYING symlink
    + Detect libm using libtool's macros
    + configure.ac: disable static libraries by default
    + python/Makefile.am: nest python docs in $(docdir)
    + python/Makefile.am: rely on global AM_INIT_AUTOMAKE
    + Makefile.am: install examples more idiomatically
    + configure.ac: remove useless AC_SUBST
    + Respect `--sysconfdir` in source files
    + Ignore configure backup file created by recent autoreconf too
    + Only install *.html and *.c example files
    + Remove --with-html-dir option
    + Rework documentation build system
    + Remove old website
    + Use AM_PATH_PYTHON/PKG_CHECK_MODULES for python bindings
    + Update genChRanges.py
    + Update build_glob.py
    + Remove ICONV_CONST test
    + Remove obsolete AC_HEADER checks
    + Don't check for standard C89 library functions
    + Don't check for standard C89 headers
    + Remove special configuration for certain maintainers
  * Test suite, CI
    + Disable network in API tests
    + testapi: remove leading slash from "/missing.xml"
    + Build Autotools CI tests out of source tree (VPATH)
    + Add --with-minimum build to CI tests
    + Fix warnings when testing --with-minimum build
    + cmake: Run all tests when threads are disabled
    + Also build CI tests with -Werror
    + Move doc/examples tests to new test suite
    + Simplify 'make check' targets
    + Fix schemas and relaxng tests
    + Remove unused result files
    + Allow missing result files in runtest
    + Move regexp tests to runtest
    + Move SVG tests to runtest.c
    + Move testModule to new test suite
    + Move testThreads to new test suite
    + Remove major parts of old test suite
    + Make testchar return an error on failure
    + Add CI job for static build
    + python/tests: open() relative to test scripts
    + Port some test scripts to Python 3
  * Documentation
    + Improve documentation of tree manipulation API
    + Update xml2-config man page
    + Consolidate man pages
    + Rename xmlcatalog_man.xml
    + Make examples a standalone HTML page
    + Fix documentation in entities.c
    + Add note about optimization flags</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661428800">- Update to version 2.10.1:
  * Regressions: Fix xmlCtxtReadDoc with encoding
  * Bug fixes: Fix HTML parser with threads and --without-legacy
  * Build system:
    + Fix build with Python 3.10
    + cmake: Disable version script on macOS
    + Remove Makefile rule to build testapi.c
  * Documentation:
    + Switch back to HTML output for API documentation
    + Port doc/examples/index.py to Python 3
    + Fix order of exports in libxml2-api.xml
    + Remove libxml2-refs.xml</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1661860800">- Update to version 2.10.2:
  * Improvements:
    + Remove set-but-unused variable in xmlXPathScanName
    + Silence -Warray-bounds warning
  * Build system
    + build: require automake-1.16.3 or later
    + Remove generated files from distribution
  * Test suite: Don't create missing.xml when running testapi
- Add configure --with-python=%{__python3} inbefore python build,
  as upstream no longer ships pre-grenerated files.
- Use sed to fix env-script-interpreter in documentation example.
- Pass with-ftp to configure, build ftp support.</changelog>
  <changelog author="pmonreal@suse.com" date="1662033600">- Build for now with --with-legacy to enable APIs that have been
  deprecated recently. (bsc#1202965)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1665748800">- Update to version 2.10.3 (bsc#1204366, CVE-2022-40303, bsc#1204367, CVE-2022-40304):
  + Security:
  - [CVE-2022-40304] Fix dict corruption caused by entity
    reference cycles
  - [CVE-2022-40303] Fix integer overflows with XML_PARSE_HUGE
  - Fix overflow check in SAX2.c
  + Build system: cmake: Set SOVERSION
- Rebase patches with quilt.</changelog>
  <changelog author="david.anes@suse.com" date="1667217600">- Add W3C conformance tests to the testsuite (bsc#1204585):
  * Added file xmlts20080827.tar.gz</changelog>
  <changelog author="daniel.garcia@suse.com" date="1681905600">- Build also for modern python version (jsc#PED-68)</changelog>
  <changelog author="david.anes@suse.com" date="1682078400">- Remove unneeded dependency (bsc#1209918).</changelog>
  <changelog author="david.anes@suse.com" date="1682078401">- Security update:
  * [CVE-2023-29469, bsc#1210412] Hashing of empty dict strings
    isn't deterministic
  - Added patch libxml2-CVE-2023-29469.patch
  * [CVE-CVE-2023-28484, bsc#1210411] NULL dereference in
    xmlSchemaFixupComplexType
  - Added patch libxml2-CVE-2023-28484-1.patch
  - Added patch libxml2-CVE-2023-28484-2.patch</changelog>
  <changelog author="david.anes@suse.com" date="1693828800">- Security update:
  * [CVE-2023-39615, bsc#1214768] Crafted xml can cause global
    buffer overflow
  - Added file libxml2-CVE-2023-39615.patch</changelog>
</package>
<package pkgid="5bb903a404fadb4739becce664930c214f1e11ac2df67777feec922f213fe929" name="python3-ply" arch="noarch">
  <version epoch="0" ver="3.10" rel="150000.3.5.1"/>
  <changelog author="saschpe@suse.de" date="1301400000">- Update to 3.4:
  + Minor patch to make cpp.py compatible with Python 3.
  + Fixed setup.py trove classifiers to properly list PLY as Python
    3 compatible.
- License changed to BSD3c
- Packaged more doc files
- Moved important docs (README, ..) to base package
- Fixed build for non-SUSE distros</changelog>
  <changelog author="coolo@suse.com" date="1329134400">- patch license to follow spdx.org standard</changelog>
  <changelog author="highwaystar.ru@gmail.com" date="1337947200">- python3 package added</changelog>
  <changelog author="toddrme2178@gmail.com" date="1337947201">- spec file cleanups</changelog>
  <changelog author="toddrme2178@gmail.com" date="1357128000">- Fix building on SLES</changelog>
  <changelog author="benoit.monin@gmx.fr" date="1431345600">- update to version 3.6:
  * If PLY is unable to create the 'parser.out' or 'parsetab.py'
    files due to permission issues, it now just issues a warning
    message and continues to operate
  * Fixed some issues related to use of packages and table file
    modules
- additional changes from version 3.5:
  * Added support for defaulted_states in the parser
  * Fixed debug logging in the parser
  * Added actions to be defined to character literals (Issue #32)
  * Import of the 'parsetab.py' file is now constrained to only
    consider the directory specified by the outputdir argument to
    yacc()
  * Changed default output directory to be the same as that in
    which the yacc grammar is defined
  * Changed the parsetab.py file signature slightly so that the
    parsetab won't regenerate if created on a different major
    version of Python
  * Fixed Issue #44 call_errorfunc() should return the result of
    errorfunc()
  * Support for versions of Python &lt;2.7 is officially dropped
  * Fixed bug related to calling yacc(start=...)
  * Added skipped tests for PyPy and Java
  * Added filter to make unit tests pass under 'python -3'
  * Fixed CPP_INTEGER regex in ply/cpp.py (Issue 21)
  * Fixed yacc validation bugs when from __future__ import
    unicode_literals is being used
  * Added support for Travis-CI
  * Added a .gitignore file
  * Fixed validation problems for source files that include a
    different source code encoding specifier
  * Fixed unit tests for yacc to eliminate random failures due to
    dict hash value randomization in Python 3.3
  * Fixed comment whitespace processing bugs in ply/cpp.py
  * Fixed token names in ply/ctokens.py to match rule names
  * Changes to functions available in panic mode error recover
  * Fixed some problems with line and position tracking and the use
    of error symbols
  * Change to doc string handling in lex module
  * Fixed issue #1: Fixed _tabversion. It should use __tabversion__
    instead of __version__
  * Fixed issue #8: Literals empty list causes IndexError
  * Fixed issue #12: Typo in code snippet in documentation
  * Fixed issue #10: Correctly escape t_XOREQUAL pattern.
- clean the test and example directories
- remove stray backup files in doc
- remove unneeded executable bit of testlex.py
- remove CFLAGS export: unneeded
- do not drop executable bit of everything in test since
  it contains subdirectories
- remove useless clean section
- remove README from package: not provided anymore</changelog>
  <changelog author="hpj@urpla.net" date="1444219200">- update to version 3.8:
  * Fixed issues related to Python 3.5. Patch contributed by Barry Warsaw.
- update to version 3.7
  * Fixed problems when reading table files from pickled data.
  * Fixed regression in handling of table modules if specified as module
    objects.   See https://github.com/dabeaz/ply/issues/63
- clean up spec
- add testing rig</changelog>
  <changelog author="tbechtold@suse.com" date="1472817600">- update to 3.9:
  * Exposed the parser state number as the parser.state attribute
    in productions and error functions.
  * Fixed Issue #88. Python3 compatibility with ply/cpp.
  * Fixed Issue #93. Ply can crash if SyntaxError is raised inside
    a production.   Not actually sure if the original implementation
    worked as documented at all.  Yacc has been modified to follow
    the spec as outlined in the CHANGES noted for 11/27/07 below.
  * Fixed Issue #97. Failure with code validation when the original
    source files aren't present.   Validation step now ignores
    the missing file.
  * Minor fixes to version numbers.</changelog>
  <changelog author="rjschwei@suse.com" date="1489665600">- Switch to single-spec build
- Update to 3.10
  * Changed grammar signature computation to not involve hashing
    functions. Parts are just combined into a big string.</changelog>
  <changelog author="toddrme2178@gmail.com" date="1499688000">- Fix wrong-script-interpreter rpmlint error.</changelog>
</package>
<package pkgid="098ac33ff219f06a9fb739bdca84cb488a058cd3aef04697156fcd36856d8560" name="python3-urllib3" arch="noarch">
  <version epoch="0" ver="1.25.10" rel="150300.4.6.1"/>
  <changelog author="tchvatal@suse.com" date="1559131200">- Add more test to skip as with new openssl some behaviour changed
  and we can't rely on them anymore</changelog>
  <changelog author="tchvatal@suse.com" date="1559908800">- Skip test_source_address_error as we raise different error with
  fixes that we provide in new python2/3</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1560945600">- Fix Upgrade from Leap 42.1/42.2 by adding Obsoletes/Provides:
  python-urllib3, fixes boo#1138746</changelog>
  <changelog author="dimstar@opensuse.org" date="1561032000">- Provides/Obsoletes does not fix the issue: we have a
  directory-to-symlink switch, which cannot be handled by RPM
  internally. Assist using pre script (boo#1138715).</changelog>
  <changelog author="dimstar@opensuse.org" date="1561118400">- Fixup pre script: the migration issue happens when changing from
  python-urllib3 to python2-urllib3: the number of installed
  instances of python2-urlliib3 is at this moment 1, unlike in
  regular updates. This is due to a name change, which consists not
  of a pure package update.</changelog>
  <changelog author="tchvatal@suse.com" date="1563796800">- Use old pytest 3.x as newer do not work with this release
  * this will be fixed with next release, just spread among
    numerous fixes in the git for quick backporting</changelog>
  <changelog author="jayvdb@gmail.com" date="1568462400">- Use have/skip_python2/3 macros to allow building only one flavour</changelog>
  <changelog author="tchvatal@suse.com" date="1568980800">- Update to 1.25.5:
  * Add mitigation for BPO-37428 affecting Python &lt;3.7.4 and OpenSSL 1.1.1+ which caused certificate verification to be enabled when using cert_reqs=CERT_NONE. (Issue #1682)
  * Propagate Retry-After header settings to subsequent retries. (Pull #1607)
  * Fix edge case where Retry-After header was still respected even when explicitly opted out of. (Pull #1607)
  * Remove dependency on rfc3986 for URL parsing.
  * Fix issue where URLs containing invalid characters within Url.auth would raise an exception instead of percent-encoding those characters.
  * Add support for HTTPResponse.auto_close = False which makes HTTP responses work well with BufferedReaders and other io module features. (Pull #1652)
  * Percent-encode invalid characters in URL for HTTPConnectionPool.request() (Pull #1673)
- Drop patch urllib3-ssl-default-context.patch
- Drop patch python-urllib3-recent-date.patch the date is recent
  enough on its own</changelog>
  <changelog author="tchvatal@suse.com" date="1569585600">- Restrict the tornado dep from tom to 5 or older release as the
  6.x changed the API</changelog>
  <changelog author="tchvatal@suse.com" date="1570017600">- Updae to 1.25.6:
  * Fix issue where tilde (~) characters were incorrectly percent-encoded in the path. (Pull #1692)</changelog>
  <changelog author="rhafer@suse.de" date="1571140800">- Require a new enough release of python-six. 1.25.6 needs at least
  1.12.0 for ensure_text() and friends.</changelog>
  <changelog author="mcalabkova@suse.com" date="1581076800">- update to 1.25.8
  * Drop support for EOL Python 3.4
  * Optimize _encode_invalid_chars
  * Preserve chunked parameter on retries
  * Allow unset SERVER_SOFTWARE in App Engine
  * Fix issue where URL fragment was sent within the request target.
  * Fix issue where an empty query section in a URL would fail to parse.
  * Remove TLS 1.3 support in SecureTransport due to Apple removing support.</changelog>
  <changelog author="mcepl@suse.com" date="1587470400">- Explicitly switch off building python 2 version.</changelog>
  <changelog author="dmueller@suse.com" date="1591099200">- update to 1.25.9 (bsc#1177120, CVE-2020-26137):
  * Added ``InvalidProxyConfigurationWarning`` which is raised when
    erroneously specifying an HTTPS proxy URL. urllib3 doesn't currently
    support connecting to HTTPS proxies but will soon be able to
    and we would like users to migrate properly without much breakage.
  * Drain connection after ``PoolManager`` redirect (Pull #1817)
  * Ensure ``load_verify_locations`` raises ``SSLError`` for all backends (Pull #1812)
  * Rename ``VerifiedHTTPSConnection`` to ``HTTPSConnection`` (Pull #1805)
  * Allow the CA certificate data to be passed as a string (Pull #1804)
  * Raise ``ValueError`` if method contains control characters (Pull #1800)
  * Add ``__repr__`` to ``Timeout`` (Pull #1795)</changelog>
  <changelog author="dmueller@suse.com" date="1596542400">- update to 1.25.10:
  * Added support for ``SSLKEYLOGFILE`` environment variable for
    logging TLS session keys with use with programs like
    Wireshark for decrypting captured web traffic (Pull #1867)
  * Fixed loading of SecureTransport libraries on macOS Big Sur
    due to the new dynamic linker cache (Pull #1905)
  * Collapse chunked request bodies data and framing into one
  call to ``send()`` to reduce the number of TCP packets by 2-4x (Pull #1906)
  * Don't insert ``None`` into ``ConnectionPool`` if the pool
    was empty when requesting a connection (Pull #1866)
  * Avoid ``hasattr`` call in ``BrotliDecoder.decompress()`` (Pull #1858)</changelog>
  <changelog author="aplanas@suse.com" date="1599652800">- Generate pyc for ssl_match_hostname too</changelog>
  <changelog author="mcepl@suse.com" date="1608206400">- Add CI variable, which makes timeouts in the test suite longer
  (gh#urllib3/urllib3#2109, bsc#1176389) and
  test_timeout_errors_cause_retries should not fail.</changelog>
  <changelog author="code@bnavigator.de" date="1609502400">- Skip test for RECENT_DATE. It is a test purely for developers.
  To maintain reproducibility, keep upstreams possibly outdated
  RECENT_DATE in the source code.</changelog>
  <changelog author="johannes.grassler@suse.com" date="1623412800">- Add CVE-2021-33503.patch (bsc#1187045, CVE-2021-33503)
  * Improve performance of sub-authority splitting in URL</changelog>
  <changelog author="daniel.garcia@suse.com" date="1696852800">- Add CVE-2023-43804.patch (bsc#1215968, CVE-2023-43804)
  gh#urllib3/urllib3#3139
  * Added the Cookie header to the list of headers to strip from
    requests when redirecting to a different host. As before,
    different headers can be set via Retry.remove_headers_on_redirect.</changelog>
</package>
<package pkgid="d634542d591dada94158be1beebf6335f563b8595feb7a92bb2057baa4a2cfad" name="runc" arch="aarch64">
  <version epoch="0" ver="1.1.8" rel="150000.49.1"/>
  <changelog author="asarai@suse.com" date="1619438400">- Backport patch to fix build on SLE-12 ppc64le.
  + 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1620820800">- Update to runc v1.0.0~rc94. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94
  Breaking Changes:
  * cgroupv1: kernel memory limits are now always ignored, as kmemcg has
    been effectively deprecated by the kernel. Users should make use of regular
    memory cgroup controls.
  Regression Fixes:
  * seccomp: fix 32-bit compilation errors
  * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code
  * runc start: fix "chdir to cwd: permission denied" for some setups
- Remove upstreamed patches:
  - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1621425600">- Update to runc v1.0.0~rc95. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95
  This release of runc contains a fix for CVE-2021-30465, and users are
  strongly recommended to update (especially if you are providing
  semi-limited access to spawn containers to untrusted users). bsc#1185405</changelog>
  <changelog author="asarai@suse.com" date="1622548800">- Update to runc v1.0.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0
  ! The usage of relative paths for mountpoints will now produce a warning
    (such configurations are outside of the spec, and in future runc will
    produce an error when given such configurations).
  * cgroupv2: devices: rework the filter generation to produce consistent
    results with cgroupv1, and always clobber any existing eBPF
    program(s) to fix runc update and avoid leaking eBPF programs
    (resulting in errors when managing containers).
  * cgroupv2: correctly convert "number of IOs" statistics in a
    cgroupv1-compatible way.
  * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.
  * cgroupv2: wait for freeze to finish before returning from the freezing
    code, optimize the method for checking whether a cgroup is frozen.
  * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94
  * cgroups/systemd: fixed returning "unit already exists" error from a systemd
    cgroup manager (regression in rc94)
  + cgroupv2: support SkipDevices with systemd driver
  + cgroup/systemd: return, not ignore, stop unit error from Destroy
  + Make "runc --version" output sane even when built with go get or
    otherwise outside of our build scripts.
  + cgroups: set SkipDevices during runc update (so we don't modify
    cgroups at all during runc update).
  + cgroup1: blkio: support BFQ weights.
  + cgroupv2: set per-device io weights if BFQ IO scheduler is available.</changelog>
  <changelog author="asarai@suse.com" date="1625140800">- Backport &lt;https://github.com/opencontainers/runc/pull/3055&gt; to fix issues
  with runc under openSUSE MicroOS's SELinux policy. boo#1187704
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1626609600">- Update to runc v1.0.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.1
  * Fixed occasional runc exec/run failure ("interrupted system call") on an
    Azure volume.
  * Fixed "unable to find groups ... token too long" error with /etc/group
    containing lines longer than 64K characters.
  * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is
    frozen. This is a regression in 1.0.0, not affecting runc itself but some
    of libcontainer users (e.g Kubernetes).
  * cgroupv2: bpf: Ignore inaccessible existing programs in case of
    permission error when handling replacement of existing bpf cgroup
    programs. This fixes a regression in 1.0.0, where some SELinux
    policies would block runc from being able to run entirely.
  * cgroup/systemd/v2: don't freeze cgroup on Set.
  * cgroup/systemd/v1: avoid unnecessary freeze on Set.
- Remove upstreamed patches:
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1629720000">- Update to runc v1.0.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.2
  * Fixed a failure to set CPU quota period in some cases on cgroup v1.
  * Fixed the inability to start a container with the "adding seccomp filter
    rule for syscall ..." error, caused by redundant seccomp rules (i.e. those
    that has action equal to the default one). Such redundant rules are now
    skipped.
  * Made release builds reproducible from now on.
  * Fixed a rare debug log race in runc init, which can result in occasional
    harmful "failed to decode ..." errors from runc run or exec.
  * Fixed the check in cgroup v1 systemd manager if a container needs to be
    frozen before Set, and add a setting to skip such freeze unconditionally.
    The previous fix for that issue, done in runc 1.0.1, was not working.</changelog>
  <changelog author="asarai@suse.com" date="1638792000">- Update to runc v1.0.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784
  bsc#1193436
  * A potential vulnerability was discovered in runc (related to an internal
    usage of netlink), however upon further investigation we discovered that
    while this bug was exploitable on the master branch of runc, no released
    version of runc could be exploited using this bug. The exploit required
    being able to create a netlink attribute with a length that would overflow a
    uint16 but this was not possible in any released version of runc. For more
    information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784.
    Due to an abundance of caution we decided to do an emergency release with
    this fix, but to reiterate we do not believe this vulnerability was
    possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for
    discovering and reporting this vulnerability so quickly.
  * Fixed inability to start a container with read-write bind mount of a
    read-only fuse host mount.
  * Fixed inability to start when read-only /dev in set in spec.
  * Fixed not removing sub-cgroups upon container delete, when rootless cgroup
    v2 is used with older systemd.
  * Fixed returning error from GetStats when hugetlb is unsupported (which
    causes excessive logging for kubernetes).</changelog>
  <changelog author="asarai@suse.com" date="1639483200">- Update to runc v1.1.0~rc1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.
  + Add support for RDMA cgroup added in Linux 4.11.
  * runc exec now produces exit code of 255 when the exec failed.
    This may help in distinguishing between runc exec failures
    (such as invalid options, non-running container or non-existent
    binary etc.) and failures of the command being executed.
  + runc run: new --keep option to skip removal exited containers artefacts.
    This might be useful to check the state (e.g. of cgroup controllers) after
    the container has￼exited.
  + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
    (the latter is just an alias for SCMP_ACT_KILL).
  + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
    users to create sophisticated seccomp filters where syscalls can be
    efficiently emulated by privileged processes on the host.
  + checkpoint/restore: add an option (--lsm-mount-context) to set
    a different LSM mount context on restore.
  + intelrdt: support ClosID parameter.
  + runc exec --cgroup: an option to specify a (non-top) in-container cgroup
    to use for the process being executed.
  + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
    machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
    run/exec now adds the container to the appropriate cgroup under it).
  + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
    behaviour.
  + mounts: add support for bind-mounts which are inaccessible after switching
    the user namespace. Note that this does not permit the container any
    additional access to the host filesystem, it simply allows containers to
    have bind-mounts configured for paths the user can access but have
    restrictive access control settings for other users.
  + Add support for recursive mount attributes using mount_setattr(2). These
    have the same names as the proposed mount(8) options -- just prepend r
    to the option name (such as rro).
  + Add runc features subcommand to allow runc users to detect what features
    runc has been built with. This includes critical information such as
    supported mount flags, hook names, and so on. Note that the output of this
    command is subject to change and will not be considered stable until runc
    1.2 at the earliest. The runtime-spec specification for this feature is
    being developed in opencontainers/runtime-spec#1130.
  * system: improve performance of /proc/$pid/stat parsing.
  * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
    the ownership of certain cgroup control files (as per
    /sys/kernel/cgroup/delegate) to allow for proper deferral to the container
    process.
  * runc checkpoint/restore: fixed for containers with an external bind mount
    which destination is a symlink.
  * cgroup: improve openat2 handling for cgroup directory handle hardening.
    runc delete -f now succeeds (rather than timing out) on a paused
    container.
  * runc run/start/exec now refuses a frozen cgroup (paused container in case of
    exec). Users can disable this using --ignore-paused.
- Update version data embedded in binary to correctly include the git commit of
  the release.
- Drop runc-rpmlintrc because we don't have runc-test anymore.</changelog>
  <changelog author="asarai@suse.com" date="1642420800">- Update to runc v1.1.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0.
  - libcontainer will now refuse to build without the nsenter package being
    correctly compiled (specifically this requires CGO to be enabled). This
    should avoid folks accidentally creating broken runc binaries (and
    incorrectly importing our internal libraries into their projects). (#3331)</changelog>
  <changelog author="asarai@suse.com" date="1648555200">- Update to runc v1.1.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.1.
  * runc run/start can now run a container with read-only /dev in OCI spec,
    rather than error out. (#3355)
  * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)
    libcontainer systemd v2 manager no longer errors out if one of the files
    listed in /sys/kernel/cgroup/delegate do not exist in container's
    cgroup. (#3387, #3404)
  * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported"
    error. (#3406)
  * libcontainer/cgroups no longer panics in cgroup v1 managers if stat
    of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)</changelog>
  <changelog author="asarai@suse.com" date="1652270400">- Update to runc v1.1.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.2.
  CVE-2022-29162 bsc#1199460
  * A bug was found in runc where runc exec --cap executed processes with
    non-empty inheritable Linux process capabilities, creating an atypical Linux
    environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and
    CVE-2022-29162. bsc#1199460
  * `runc spec` no longer sets any inheritable capabilities in the created
    example OCI spec (`config.json`) file.</changelog>
  <changelog author="asarai@suse.com" date="1652356800">- Add ExcludeArch for s390 (not s390x) since we've never supported it.</changelog>
  <changelog author="asarai@suse.com" date="1653307200">- Backport &lt;https://github.com/opencontainers/runc/pull/3474&gt; to fix issues
  with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by
  that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565
  + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="asarai@suse.com" date="1654776000">- Update to runc v1.1.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.3.
  (Includes a fix for bsc#1200088.)
  * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on
    s390 and s390x. This solves the issue where syscalls the host kernel did not
    support would return `-EPERM` despite the existence of the `-ENOSYS` stub
    code (this was due to how s390x does syscall multiplexing).
  * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as
    intended; this fix does not affect runc binary itself but is important for
    libcontainer users such as Kubernetes.
  * Inability to compile with recent clang due to an issue with duplicate
    constants in libseccomp-golang.
  * When using systemd cgroup driver, skip adding device paths that don't exist,
    to stop systemd from emitting warnings about those paths.
  * Socket activation was failing when more than 3 sockets were used.
  * Various CI fixes.
  * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.
  * runc static binaries are now linked against libseccomp v2.5.4.
- Remove upstreamed patches:
  - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="fvogt@suse.com" date="1661947200">- Update to runc v1.1.4. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.4.
  bsc#1202021
  * Fix mounting via wrong proc fd. When the user and mount namespaces are
    used, and the bind mount is followed by the cgroup mount in the spec,
    the cgroup was mounted using the bind mount's mount fd.
  * Switch kill() in libcontainer/nsenter to sane_kill().
  * Fix "permission denied" error from runc run on noexec fs.
  * Fix failed exec after systemctl daemon-reload. Due to a regression
    in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and
    was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.
    (boo#1202821)</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to runc v1.1.5. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.5&gt;.
  Includes fixes for the following CVEs:
  - CVE-2023-25809 bsc#1209884
  - CVE-2023-27561 bsc#1208962
  - CVE-2023-28642 bsc#1209888
  * Fix the inability to use `/dev/null` when inside a container. bsc#1168481
  * Fix changing the ownership of host's `/dev/null` caused by fd redirection
    (a regression in 1.1.1). bsc#1207004
  * Fix rare runc exec/enter unshare error on older kernels.
  * nsexec: Check for errors in `write_log()`.
- Drop version-specific Go requirement.</changelog>
  <changelog author="asarai@suse.com" date="1681300800">- Update to runc v1.1.6. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.6&gt;.</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to runc v1.1.7. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.7&gt;.
- Update runc.keyring to upstream version.</changelog>
  <changelog author="asarai@suse.com" date="1689768000">- Update to runc v1.1.8. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.8&gt;.</changelog>
</package>
<package pkgid="dd11e7c19bf6b73c06cc371b9e2be99d34003757aef0d7093a8266143f787a8c" name="runc" arch="s390x">
  <version epoch="0" ver="1.1.8" rel="150000.49.1"/>
  <changelog author="asarai@suse.com" date="1619438400">- Backport patch to fix build on SLE-12 ppc64le.
  + 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1620820800">- Update to runc v1.0.0~rc94. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94
  Breaking Changes:
  * cgroupv1: kernel memory limits are now always ignored, as kmemcg has
    been effectively deprecated by the kernel. Users should make use of regular
    memory cgroup controls.
  Regression Fixes:
  * seccomp: fix 32-bit compilation errors
  * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code
  * runc start: fix "chdir to cwd: permission denied" for some setups
- Remove upstreamed patches:
  - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1621425600">- Update to runc v1.0.0~rc95. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95
  This release of runc contains a fix for CVE-2021-30465, and users are
  strongly recommended to update (especially if you are providing
  semi-limited access to spawn containers to untrusted users). bsc#1185405</changelog>
  <changelog author="asarai@suse.com" date="1622548800">- Update to runc v1.0.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0
  ! The usage of relative paths for mountpoints will now produce a warning
    (such configurations are outside of the spec, and in future runc will
    produce an error when given such configurations).
  * cgroupv2: devices: rework the filter generation to produce consistent
    results with cgroupv1, and always clobber any existing eBPF
    program(s) to fix runc update and avoid leaking eBPF programs
    (resulting in errors when managing containers).
  * cgroupv2: correctly convert "number of IOs" statistics in a
    cgroupv1-compatible way.
  * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.
  * cgroupv2: wait for freeze to finish before returning from the freezing
    code, optimize the method for checking whether a cgroup is frozen.
  * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94
  * cgroups/systemd: fixed returning "unit already exists" error from a systemd
    cgroup manager (regression in rc94)
  + cgroupv2: support SkipDevices with systemd driver
  + cgroup/systemd: return, not ignore, stop unit error from Destroy
  + Make "runc --version" output sane even when built with go get or
    otherwise outside of our build scripts.
  + cgroups: set SkipDevices during runc update (so we don't modify
    cgroups at all during runc update).
  + cgroup1: blkio: support BFQ weights.
  + cgroupv2: set per-device io weights if BFQ IO scheduler is available.</changelog>
  <changelog author="asarai@suse.com" date="1625140800">- Backport &lt;https://github.com/opencontainers/runc/pull/3055&gt; to fix issues
  with runc under openSUSE MicroOS's SELinux policy. boo#1187704
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1626609600">- Update to runc v1.0.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.1
  * Fixed occasional runc exec/run failure ("interrupted system call") on an
    Azure volume.
  * Fixed "unable to find groups ... token too long" error with /etc/group
    containing lines longer than 64K characters.
  * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is
    frozen. This is a regression in 1.0.0, not affecting runc itself but some
    of libcontainer users (e.g Kubernetes).
  * cgroupv2: bpf: Ignore inaccessible existing programs in case of
    permission error when handling replacement of existing bpf cgroup
    programs. This fixes a regression in 1.0.0, where some SELinux
    policies would block runc from being able to run entirely.
  * cgroup/systemd/v2: don't freeze cgroup on Set.
  * cgroup/systemd/v1: avoid unnecessary freeze on Set.
- Remove upstreamed patches:
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1629720000">- Update to runc v1.0.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.2
  * Fixed a failure to set CPU quota period in some cases on cgroup v1.
  * Fixed the inability to start a container with the "adding seccomp filter
    rule for syscall ..." error, caused by redundant seccomp rules (i.e. those
    that has action equal to the default one). Such redundant rules are now
    skipped.
  * Made release builds reproducible from now on.
  * Fixed a rare debug log race in runc init, which can result in occasional
    harmful "failed to decode ..." errors from runc run or exec.
  * Fixed the check in cgroup v1 systemd manager if a container needs to be
    frozen before Set, and add a setting to skip such freeze unconditionally.
    The previous fix for that issue, done in runc 1.0.1, was not working.</changelog>
  <changelog author="asarai@suse.com" date="1638792000">- Update to runc v1.0.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784
  bsc#1193436
  * A potential vulnerability was discovered in runc (related to an internal
    usage of netlink), however upon further investigation we discovered that
    while this bug was exploitable on the master branch of runc, no released
    version of runc could be exploited using this bug. The exploit required
    being able to create a netlink attribute with a length that would overflow a
    uint16 but this was not possible in any released version of runc. For more
    information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784.
    Due to an abundance of caution we decided to do an emergency release with
    this fix, but to reiterate we do not believe this vulnerability was
    possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for
    discovering and reporting this vulnerability so quickly.
  * Fixed inability to start a container with read-write bind mount of a
    read-only fuse host mount.
  * Fixed inability to start when read-only /dev in set in spec.
  * Fixed not removing sub-cgroups upon container delete, when rootless cgroup
    v2 is used with older systemd.
  * Fixed returning error from GetStats when hugetlb is unsupported (which
    causes excessive logging for kubernetes).</changelog>
  <changelog author="asarai@suse.com" date="1639483200">- Update to runc v1.1.0~rc1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.
  + Add support for RDMA cgroup added in Linux 4.11.
  * runc exec now produces exit code of 255 when the exec failed.
    This may help in distinguishing between runc exec failures
    (such as invalid options, non-running container or non-existent
    binary etc.) and failures of the command being executed.
  + runc run: new --keep option to skip removal exited containers artefacts.
    This might be useful to check the state (e.g. of cgroup controllers) after
    the container has￼exited.
  + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
    (the latter is just an alias for SCMP_ACT_KILL).
  + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
    users to create sophisticated seccomp filters where syscalls can be
    efficiently emulated by privileged processes on the host.
  + checkpoint/restore: add an option (--lsm-mount-context) to set
    a different LSM mount context on restore.
  + intelrdt: support ClosID parameter.
  + runc exec --cgroup: an option to specify a (non-top) in-container cgroup
    to use for the process being executed.
  + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
    machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
    run/exec now adds the container to the appropriate cgroup under it).
  + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
    behaviour.
  + mounts: add support for bind-mounts which are inaccessible after switching
    the user namespace. Note that this does not permit the container any
    additional access to the host filesystem, it simply allows containers to
    have bind-mounts configured for paths the user can access but have
    restrictive access control settings for other users.
  + Add support for recursive mount attributes using mount_setattr(2). These
    have the same names as the proposed mount(8) options -- just prepend r
    to the option name (such as rro).
  + Add runc features subcommand to allow runc users to detect what features
    runc has been built with. This includes critical information such as
    supported mount flags, hook names, and so on. Note that the output of this
    command is subject to change and will not be considered stable until runc
    1.2 at the earliest. The runtime-spec specification for this feature is
    being developed in opencontainers/runtime-spec#1130.
  * system: improve performance of /proc/$pid/stat parsing.
  * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
    the ownership of certain cgroup control files (as per
    /sys/kernel/cgroup/delegate) to allow for proper deferral to the container
    process.
  * runc checkpoint/restore: fixed for containers with an external bind mount
    which destination is a symlink.
  * cgroup: improve openat2 handling for cgroup directory handle hardening.
    runc delete -f now succeeds (rather than timing out) on a paused
    container.
  * runc run/start/exec now refuses a frozen cgroup (paused container in case of
    exec). Users can disable this using --ignore-paused.
- Update version data embedded in binary to correctly include the git commit of
  the release.
- Drop runc-rpmlintrc because we don't have runc-test anymore.</changelog>
  <changelog author="asarai@suse.com" date="1642420800">- Update to runc v1.1.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0.
  - libcontainer will now refuse to build without the nsenter package being
    correctly compiled (specifically this requires CGO to be enabled). This
    should avoid folks accidentally creating broken runc binaries (and
    incorrectly importing our internal libraries into their projects). (#3331)</changelog>
  <changelog author="asarai@suse.com" date="1648555200">- Update to runc v1.1.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.1.
  * runc run/start can now run a container with read-only /dev in OCI spec,
    rather than error out. (#3355)
  * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)
    libcontainer systemd v2 manager no longer errors out if one of the files
    listed in /sys/kernel/cgroup/delegate do not exist in container's
    cgroup. (#3387, #3404)
  * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported"
    error. (#3406)
  * libcontainer/cgroups no longer panics in cgroup v1 managers if stat
    of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)</changelog>
  <changelog author="asarai@suse.com" date="1652270400">- Update to runc v1.1.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.2.
  CVE-2022-29162 bsc#1199460
  * A bug was found in runc where runc exec --cap executed processes with
    non-empty inheritable Linux process capabilities, creating an atypical Linux
    environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and
    CVE-2022-29162. bsc#1199460
  * `runc spec` no longer sets any inheritable capabilities in the created
    example OCI spec (`config.json`) file.</changelog>
  <changelog author="asarai@suse.com" date="1652356800">- Add ExcludeArch for s390 (not s390x) since we've never supported it.</changelog>
  <changelog author="asarai@suse.com" date="1653307200">- Backport &lt;https://github.com/opencontainers/runc/pull/3474&gt; to fix issues
  with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by
  that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565
  + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="asarai@suse.com" date="1654776000">- Update to runc v1.1.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.3.
  (Includes a fix for bsc#1200088.)
  * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on
    s390 and s390x. This solves the issue where syscalls the host kernel did not
    support would return `-EPERM` despite the existence of the `-ENOSYS` stub
    code (this was due to how s390x does syscall multiplexing).
  * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as
    intended; this fix does not affect runc binary itself but is important for
    libcontainer users such as Kubernetes.
  * Inability to compile with recent clang due to an issue with duplicate
    constants in libseccomp-golang.
  * When using systemd cgroup driver, skip adding device paths that don't exist,
    to stop systemd from emitting warnings about those paths.
  * Socket activation was failing when more than 3 sockets were used.
  * Various CI fixes.
  * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.
  * runc static binaries are now linked against libseccomp v2.5.4.
- Remove upstreamed patches:
  - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="fvogt@suse.com" date="1661947200">- Update to runc v1.1.4. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.4.
  bsc#1202021
  * Fix mounting via wrong proc fd. When the user and mount namespaces are
    used, and the bind mount is followed by the cgroup mount in the spec,
    the cgroup was mounted using the bind mount's mount fd.
  * Switch kill() in libcontainer/nsenter to sane_kill().
  * Fix "permission denied" error from runc run on noexec fs.
  * Fix failed exec after systemctl daemon-reload. Due to a regression
    in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and
    was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.
    (boo#1202821)</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to runc v1.1.5. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.5&gt;.
  Includes fixes for the following CVEs:
  - CVE-2023-25809 bsc#1209884
  - CVE-2023-27561 bsc#1208962
  - CVE-2023-28642 bsc#1209888
  * Fix the inability to use `/dev/null` when inside a container. bsc#1168481
  * Fix changing the ownership of host's `/dev/null` caused by fd redirection
    (a regression in 1.1.1). bsc#1207004
  * Fix rare runc exec/enter unshare error on older kernels.
  * nsexec: Check for errors in `write_log()`.
- Drop version-specific Go requirement.</changelog>
  <changelog author="asarai@suse.com" date="1681300800">- Update to runc v1.1.6. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.6&gt;.</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to runc v1.1.7. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.7&gt;.
- Update runc.keyring to upstream version.</changelog>
  <changelog author="asarai@suse.com" date="1689768000">- Update to runc v1.1.8. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.8&gt;.</changelog>
</package>
<package pkgid="fa68f187f5d24519db4a73fc7be537e5dfacb69623b5b3a0e438fcd70821a4a5" name="runc" arch="src">
  <version epoch="0" ver="1.1.8" rel="150000.49.1"/>
  <changelog author="asarai@suse.com" date="1619438400">- Backport patch to fix build on SLE-12 ppc64le.
  + 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1620820800">- Update to runc v1.0.0~rc94. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94
  Breaking Changes:
  * cgroupv1: kernel memory limits are now always ignored, as kmemcg has
    been effectively deprecated by the kernel. Users should make use of regular
    memory cgroup controls.
  Regression Fixes:
  * seccomp: fix 32-bit compilation errors
  * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code
  * runc start: fix "chdir to cwd: permission denied" for some setups
- Remove upstreamed patches:
  - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1621425600">- Update to runc v1.0.0~rc95. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95
  This release of runc contains a fix for CVE-2021-30465, and users are
  strongly recommended to update (especially if you are providing
  semi-limited access to spawn containers to untrusted users). bsc#1185405</changelog>
  <changelog author="asarai@suse.com" date="1622548800">- Update to runc v1.0.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0
  ! The usage of relative paths for mountpoints will now produce a warning
    (such configurations are outside of the spec, and in future runc will
    produce an error when given such configurations).
  * cgroupv2: devices: rework the filter generation to produce consistent
    results with cgroupv1, and always clobber any existing eBPF
    program(s) to fix runc update and avoid leaking eBPF programs
    (resulting in errors when managing containers).
  * cgroupv2: correctly convert "number of IOs" statistics in a
    cgroupv1-compatible way.
  * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.
  * cgroupv2: wait for freeze to finish before returning from the freezing
    code, optimize the method for checking whether a cgroup is frozen.
  * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94
  * cgroups/systemd: fixed returning "unit already exists" error from a systemd
    cgroup manager (regression in rc94)
  + cgroupv2: support SkipDevices with systemd driver
  + cgroup/systemd: return, not ignore, stop unit error from Destroy
  + Make "runc --version" output sane even when built with go get or
    otherwise outside of our build scripts.
  + cgroups: set SkipDevices during runc update (so we don't modify
    cgroups at all during runc update).
  + cgroup1: blkio: support BFQ weights.
  + cgroupv2: set per-device io weights if BFQ IO scheduler is available.</changelog>
  <changelog author="asarai@suse.com" date="1625140800">- Backport &lt;https://github.com/opencontainers/runc/pull/3055&gt; to fix issues
  with runc under openSUSE MicroOS's SELinux policy. boo#1187704
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1626609600">- Update to runc v1.0.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.1
  * Fixed occasional runc exec/run failure ("interrupted system call") on an
    Azure volume.
  * Fixed "unable to find groups ... token too long" error with /etc/group
    containing lines longer than 64K characters.
  * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is
    frozen. This is a regression in 1.0.0, not affecting runc itself but some
    of libcontainer users (e.g Kubernetes).
  * cgroupv2: bpf: Ignore inaccessible existing programs in case of
    permission error when handling replacement of existing bpf cgroup
    programs. This fixes a regression in 1.0.0, where some SELinux
    policies would block runc from being able to run entirely.
  * cgroup/systemd/v2: don't freeze cgroup on Set.
  * cgroup/systemd/v1: avoid unnecessary freeze on Set.
- Remove upstreamed patches:
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1629720000">- Update to runc v1.0.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.2
  * Fixed a failure to set CPU quota period in some cases on cgroup v1.
  * Fixed the inability to start a container with the "adding seccomp filter
    rule for syscall ..." error, caused by redundant seccomp rules (i.e. those
    that has action equal to the default one). Such redundant rules are now
    skipped.
  * Made release builds reproducible from now on.
  * Fixed a rare debug log race in runc init, which can result in occasional
    harmful "failed to decode ..." errors from runc run or exec.
  * Fixed the check in cgroup v1 systemd manager if a container needs to be
    frozen before Set, and add a setting to skip such freeze unconditionally.
    The previous fix for that issue, done in runc 1.0.1, was not working.</changelog>
  <changelog author="asarai@suse.com" date="1638792000">- Update to runc v1.0.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784
  bsc#1193436
  * A potential vulnerability was discovered in runc (related to an internal
    usage of netlink), however upon further investigation we discovered that
    while this bug was exploitable on the master branch of runc, no released
    version of runc could be exploited using this bug. The exploit required
    being able to create a netlink attribute with a length that would overflow a
    uint16 but this was not possible in any released version of runc. For more
    information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784.
    Due to an abundance of caution we decided to do an emergency release with
    this fix, but to reiterate we do not believe this vulnerability was
    possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for
    discovering and reporting this vulnerability so quickly.
  * Fixed inability to start a container with read-write bind mount of a
    read-only fuse host mount.
  * Fixed inability to start when read-only /dev in set in spec.
  * Fixed not removing sub-cgroups upon container delete, when rootless cgroup
    v2 is used with older systemd.
  * Fixed returning error from GetStats when hugetlb is unsupported (which
    causes excessive logging for kubernetes).</changelog>
  <changelog author="asarai@suse.com" date="1639483200">- Update to runc v1.1.0~rc1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.
  + Add support for RDMA cgroup added in Linux 4.11.
  * runc exec now produces exit code of 255 when the exec failed.
    This may help in distinguishing between runc exec failures
    (such as invalid options, non-running container or non-existent
    binary etc.) and failures of the command being executed.
  + runc run: new --keep option to skip removal exited containers artefacts.
    This might be useful to check the state (e.g. of cgroup controllers) after
    the container has￼exited.
  + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
    (the latter is just an alias for SCMP_ACT_KILL).
  + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
    users to create sophisticated seccomp filters where syscalls can be
    efficiently emulated by privileged processes on the host.
  + checkpoint/restore: add an option (--lsm-mount-context) to set
    a different LSM mount context on restore.
  + intelrdt: support ClosID parameter.
  + runc exec --cgroup: an option to specify a (non-top) in-container cgroup
    to use for the process being executed.
  + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
    machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
    run/exec now adds the container to the appropriate cgroup under it).
  + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
    behaviour.
  + mounts: add support for bind-mounts which are inaccessible after switching
    the user namespace. Note that this does not permit the container any
    additional access to the host filesystem, it simply allows containers to
    have bind-mounts configured for paths the user can access but have
    restrictive access control settings for other users.
  + Add support for recursive mount attributes using mount_setattr(2). These
    have the same names as the proposed mount(8) options -- just prepend r
    to the option name (such as rro).
  + Add runc features subcommand to allow runc users to detect what features
    runc has been built with. This includes critical information such as
    supported mount flags, hook names, and so on. Note that the output of this
    command is subject to change and will not be considered stable until runc
    1.2 at the earliest. The runtime-spec specification for this feature is
    being developed in opencontainers/runtime-spec#1130.
  * system: improve performance of /proc/$pid/stat parsing.
  * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
    the ownership of certain cgroup control files (as per
    /sys/kernel/cgroup/delegate) to allow for proper deferral to the container
    process.
  * runc checkpoint/restore: fixed for containers with an external bind mount
    which destination is a symlink.
  * cgroup: improve openat2 handling for cgroup directory handle hardening.
    runc delete -f now succeeds (rather than timing out) on a paused
    container.
  * runc run/start/exec now refuses a frozen cgroup (paused container in case of
    exec). Users can disable this using --ignore-paused.
- Update version data embedded in binary to correctly include the git commit of
  the release.
- Drop runc-rpmlintrc because we don't have runc-test anymore.</changelog>
  <changelog author="asarai@suse.com" date="1642420800">- Update to runc v1.1.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0.
  - libcontainer will now refuse to build without the nsenter package being
    correctly compiled (specifically this requires CGO to be enabled). This
    should avoid folks accidentally creating broken runc binaries (and
    incorrectly importing our internal libraries into their projects). (#3331)</changelog>
  <changelog author="asarai@suse.com" date="1648555200">- Update to runc v1.1.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.1.
  * runc run/start can now run a container with read-only /dev in OCI spec,
    rather than error out. (#3355)
  * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)
    libcontainer systemd v2 manager no longer errors out if one of the files
    listed in /sys/kernel/cgroup/delegate do not exist in container's
    cgroup. (#3387, #3404)
  * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported"
    error. (#3406)
  * libcontainer/cgroups no longer panics in cgroup v1 managers if stat
    of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)</changelog>
  <changelog author="asarai@suse.com" date="1652270400">- Update to runc v1.1.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.2.
  CVE-2022-29162 bsc#1199460
  * A bug was found in runc where runc exec --cap executed processes with
    non-empty inheritable Linux process capabilities, creating an atypical Linux
    environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and
    CVE-2022-29162. bsc#1199460
  * `runc spec` no longer sets any inheritable capabilities in the created
    example OCI spec (`config.json`) file.</changelog>
  <changelog author="asarai@suse.com" date="1652356800">- Add ExcludeArch for s390 (not s390x) since we've never supported it.</changelog>
  <changelog author="asarai@suse.com" date="1653307200">- Backport &lt;https://github.com/opencontainers/runc/pull/3474&gt; to fix issues
  with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by
  that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565
  + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="asarai@suse.com" date="1654776000">- Update to runc v1.1.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.3.
  (Includes a fix for bsc#1200088.)
  * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on
    s390 and s390x. This solves the issue where syscalls the host kernel did not
    support would return `-EPERM` despite the existence of the `-ENOSYS` stub
    code (this was due to how s390x does syscall multiplexing).
  * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as
    intended; this fix does not affect runc binary itself but is important for
    libcontainer users such as Kubernetes.
  * Inability to compile with recent clang due to an issue with duplicate
    constants in libseccomp-golang.
  * When using systemd cgroup driver, skip adding device paths that don't exist,
    to stop systemd from emitting warnings about those paths.
  * Socket activation was failing when more than 3 sockets were used.
  * Various CI fixes.
  * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.
  * runc static binaries are now linked against libseccomp v2.5.4.
- Remove upstreamed patches:
  - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="fvogt@suse.com" date="1661947200">- Update to runc v1.1.4. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.4.
  bsc#1202021
  * Fix mounting via wrong proc fd. When the user and mount namespaces are
    used, and the bind mount is followed by the cgroup mount in the spec,
    the cgroup was mounted using the bind mount's mount fd.
  * Switch kill() in libcontainer/nsenter to sane_kill().
  * Fix "permission denied" error from runc run on noexec fs.
  * Fix failed exec after systemctl daemon-reload. Due to a regression
    in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and
    was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.
    (boo#1202821)</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to runc v1.1.5. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.5&gt;.
  Includes fixes for the following CVEs:
  - CVE-2023-25809 bsc#1209884
  - CVE-2023-27561 bsc#1208962
  - CVE-2023-28642 bsc#1209888
  * Fix the inability to use `/dev/null` when inside a container. bsc#1168481
  * Fix changing the ownership of host's `/dev/null` caused by fd redirection
    (a regression in 1.1.1). bsc#1207004
  * Fix rare runc exec/enter unshare error on older kernels.
  * nsexec: Check for errors in `write_log()`.
- Drop version-specific Go requirement.</changelog>
  <changelog author="asarai@suse.com" date="1681300800">- Update to runc v1.1.6. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.6&gt;.</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to runc v1.1.7. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.7&gt;.
- Update runc.keyring to upstream version.</changelog>
  <changelog author="asarai@suse.com" date="1689768000">- Update to runc v1.1.8. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.8&gt;.</changelog>
</package>
<package pkgid="6342f2ce05a79bda1b519e49797136f480c61000f734ee363adc62ddbbb5059e" name="runc" arch="x86_64">
  <version epoch="0" ver="1.1.8" rel="150000.49.1"/>
  <changelog author="asarai@suse.com" date="1619438400">- Backport patch to fix build on SLE-12 ppc64le.
  + 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1620820800">- Update to runc v1.0.0~rc94. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94
  Breaking Changes:
  * cgroupv1: kernel memory limits are now always ignored, as kmemcg has
    been effectively deprecated by the kernel. Users should make use of regular
    memory cgroup controls.
  Regression Fixes:
  * seccomp: fix 32-bit compilation errors
  * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code
  * runc start: fix "chdir to cwd: permission denied" for some setups
- Remove upstreamed patches:
  - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1621425600">- Update to runc v1.0.0~rc95. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95
  This release of runc contains a fix for CVE-2021-30465, and users are
  strongly recommended to update (especially if you are providing
  semi-limited access to spawn containers to untrusted users). bsc#1185405</changelog>
  <changelog author="asarai@suse.com" date="1622548800">- Update to runc v1.0.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0
  ! The usage of relative paths for mountpoints will now produce a warning
    (such configurations are outside of the spec, and in future runc will
    produce an error when given such configurations).
  * cgroupv2: devices: rework the filter generation to produce consistent
    results with cgroupv1, and always clobber any existing eBPF
    program(s) to fix runc update and avoid leaking eBPF programs
    (resulting in errors when managing containers).
  * cgroupv2: correctly convert "number of IOs" statistics in a
    cgroupv1-compatible way.
  * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.
  * cgroupv2: wait for freeze to finish before returning from the freezing
    code, optimize the method for checking whether a cgroup is frozen.
  * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94
  * cgroups/systemd: fixed returning "unit already exists" error from a systemd
    cgroup manager (regression in rc94)
  + cgroupv2: support SkipDevices with systemd driver
  + cgroup/systemd: return, not ignore, stop unit error from Destroy
  + Make "runc --version" output sane even when built with go get or
    otherwise outside of our build scripts.
  + cgroups: set SkipDevices during runc update (so we don't modify
    cgroups at all during runc update).
  + cgroup1: blkio: support BFQ weights.
  + cgroupv2: set per-device io weights if BFQ IO scheduler is available.</changelog>
  <changelog author="asarai@suse.com" date="1625140800">- Backport &lt;https://github.com/opencontainers/runc/pull/3055&gt; to fix issues
  with runc under openSUSE MicroOS's SELinux policy. boo#1187704
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1626609600">- Update to runc v1.0.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.1
  * Fixed occasional runc exec/run failure ("interrupted system call") on an
    Azure volume.
  * Fixed "unable to find groups ... token too long" error with /etc/group
    containing lines longer than 64K characters.
  * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is
    frozen. This is a regression in 1.0.0, not affecting runc itself but some
    of libcontainer users (e.g Kubernetes).
  * cgroupv2: bpf: Ignore inaccessible existing programs in case of
    permission error when handling replacement of existing bpf cgroup
    programs. This fixes a regression in 1.0.0, where some SELinux
    policies would block runc from being able to run entirely.
  * cgroup/systemd/v2: don't freeze cgroup on Set.
  * cgroup/systemd/v1: avoid unnecessary freeze on Set.
- Remove upstreamed patches:
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1629720000">- Update to runc v1.0.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.2
  * Fixed a failure to set CPU quota period in some cases on cgroup v1.
  * Fixed the inability to start a container with the "adding seccomp filter
    rule for syscall ..." error, caused by redundant seccomp rules (i.e. those
    that has action equal to the default one). Such redundant rules are now
    skipped.
  * Made release builds reproducible from now on.
  * Fixed a rare debug log race in runc init, which can result in occasional
    harmful "failed to decode ..." errors from runc run or exec.
  * Fixed the check in cgroup v1 systemd manager if a container needs to be
    frozen before Set, and add a setting to skip such freeze unconditionally.
    The previous fix for that issue, done in runc 1.0.1, was not working.</changelog>
  <changelog author="asarai@suse.com" date="1638792000">- Update to runc v1.0.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784
  bsc#1193436
  * A potential vulnerability was discovered in runc (related to an internal
    usage of netlink), however upon further investigation we discovered that
    while this bug was exploitable on the master branch of runc, no released
    version of runc could be exploited using this bug. The exploit required
    being able to create a netlink attribute with a length that would overflow a
    uint16 but this was not possible in any released version of runc. For more
    information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784.
    Due to an abundance of caution we decided to do an emergency release with
    this fix, but to reiterate we do not believe this vulnerability was
    possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for
    discovering and reporting this vulnerability so quickly.
  * Fixed inability to start a container with read-write bind mount of a
    read-only fuse host mount.
  * Fixed inability to start when read-only /dev in set in spec.
  * Fixed not removing sub-cgroups upon container delete, when rootless cgroup
    v2 is used with older systemd.
  * Fixed returning error from GetStats when hugetlb is unsupported (which
    causes excessive logging for kubernetes).</changelog>
  <changelog author="asarai@suse.com" date="1639483200">- Update to runc v1.1.0~rc1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.
  + Add support for RDMA cgroup added in Linux 4.11.
  * runc exec now produces exit code of 255 when the exec failed.
    This may help in distinguishing between runc exec failures
    (such as invalid options, non-running container or non-existent
    binary etc.) and failures of the command being executed.
  + runc run: new --keep option to skip removal exited containers artefacts.
    This might be useful to check the state (e.g. of cgroup controllers) after
    the container has￼exited.
  + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
    (the latter is just an alias for SCMP_ACT_KILL).
  + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
    users to create sophisticated seccomp filters where syscalls can be
    efficiently emulated by privileged processes on the host.
  + checkpoint/restore: add an option (--lsm-mount-context) to set
    a different LSM mount context on restore.
  + intelrdt: support ClosID parameter.
  + runc exec --cgroup: an option to specify a (non-top) in-container cgroup
    to use for the process being executed.
  + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
    machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
    run/exec now adds the container to the appropriate cgroup under it).
  + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
    behaviour.
  + mounts: add support for bind-mounts which are inaccessible after switching
    the user namespace. Note that this does not permit the container any
    additional access to the host filesystem, it simply allows containers to
    have bind-mounts configured for paths the user can access but have
    restrictive access control settings for other users.
  + Add support for recursive mount attributes using mount_setattr(2). These
    have the same names as the proposed mount(8) options -- just prepend r
    to the option name (such as rro).
  + Add runc features subcommand to allow runc users to detect what features
    runc has been built with. This includes critical information such as
    supported mount flags, hook names, and so on. Note that the output of this
    command is subject to change and will not be considered stable until runc
    1.2 at the earliest. The runtime-spec specification for this feature is
    being developed in opencontainers/runtime-spec#1130.
  * system: improve performance of /proc/$pid/stat parsing.
  * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
    the ownership of certain cgroup control files (as per
    /sys/kernel/cgroup/delegate) to allow for proper deferral to the container
    process.
  * runc checkpoint/restore: fixed for containers with an external bind mount
    which destination is a symlink.
  * cgroup: improve openat2 handling for cgroup directory handle hardening.
    runc delete -f now succeeds (rather than timing out) on a paused
    container.
  * runc run/start/exec now refuses a frozen cgroup (paused container in case of
    exec). Users can disable this using --ignore-paused.
- Update version data embedded in binary to correctly include the git commit of
  the release.
- Drop runc-rpmlintrc because we don't have runc-test anymore.</changelog>
  <changelog author="asarai@suse.com" date="1642420800">- Update to runc v1.1.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0.
  - libcontainer will now refuse to build without the nsenter package being
    correctly compiled (specifically this requires CGO to be enabled). This
    should avoid folks accidentally creating broken runc binaries (and
    incorrectly importing our internal libraries into their projects). (#3331)</changelog>
  <changelog author="asarai@suse.com" date="1648555200">- Update to runc v1.1.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.1.
  * runc run/start can now run a container with read-only /dev in OCI spec,
    rather than error out. (#3355)
  * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)
    libcontainer systemd v2 manager no longer errors out if one of the files
    listed in /sys/kernel/cgroup/delegate do not exist in container's
    cgroup. (#3387, #3404)
  * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported"
    error. (#3406)
  * libcontainer/cgroups no longer panics in cgroup v1 managers if stat
    of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)</changelog>
  <changelog author="asarai@suse.com" date="1652270400">- Update to runc v1.1.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.2.
  CVE-2022-29162 bsc#1199460
  * A bug was found in runc where runc exec --cap executed processes with
    non-empty inheritable Linux process capabilities, creating an atypical Linux
    environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and
    CVE-2022-29162. bsc#1199460
  * `runc spec` no longer sets any inheritable capabilities in the created
    example OCI spec (`config.json`) file.</changelog>
  <changelog author="asarai@suse.com" date="1652356800">- Add ExcludeArch for s390 (not s390x) since we've never supported it.</changelog>
  <changelog author="asarai@suse.com" date="1653307200">- Backport &lt;https://github.com/opencontainers/runc/pull/3474&gt; to fix issues
  with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by
  that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565
  + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="asarai@suse.com" date="1654776000">- Update to runc v1.1.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.3.
  (Includes a fix for bsc#1200088.)
  * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on
    s390 and s390x. This solves the issue where syscalls the host kernel did not
    support would return `-EPERM` despite the existence of the `-ENOSYS` stub
    code (this was due to how s390x does syscall multiplexing).
  * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as
    intended; this fix does not affect runc binary itself but is important for
    libcontainer users such as Kubernetes.
  * Inability to compile with recent clang due to an issue with duplicate
    constants in libseccomp-golang.
  * When using systemd cgroup driver, skip adding device paths that don't exist,
    to stop systemd from emitting warnings about those paths.
  * Socket activation was failing when more than 3 sockets were used.
  * Various CI fixes.
  * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.
  * runc static binaries are now linked against libseccomp v2.5.4.
- Remove upstreamed patches:
  - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="fvogt@suse.com" date="1661947200">- Update to runc v1.1.4. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.4.
  bsc#1202021
  * Fix mounting via wrong proc fd. When the user and mount namespaces are
    used, and the bind mount is followed by the cgroup mount in the spec,
    the cgroup was mounted using the bind mount's mount fd.
  * Switch kill() in libcontainer/nsenter to sane_kill().
  * Fix "permission denied" error from runc run on noexec fs.
  * Fix failed exec after systemctl daemon-reload. Due to a regression
    in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and
    was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.
    (boo#1202821)</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to runc v1.1.5. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.5&gt;.
  Includes fixes for the following CVEs:
  - CVE-2023-25809 bsc#1209884
  - CVE-2023-27561 bsc#1208962
  - CVE-2023-28642 bsc#1209888
  * Fix the inability to use `/dev/null` when inside a container. bsc#1168481
  * Fix changing the ownership of host's `/dev/null` caused by fd redirection
    (a regression in 1.1.1). bsc#1207004
  * Fix rare runc exec/enter unshare error on older kernels.
  * nsexec: Check for errors in `write_log()`.
- Drop version-specific Go requirement.</changelog>
  <changelog author="asarai@suse.com" date="1681300800">- Update to runc v1.1.6. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.6&gt;.</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to runc v1.1.7. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.7&gt;.
- Update runc.keyring to upstream version.</changelog>
  <changelog author="asarai@suse.com" date="1689768000">- Update to runc v1.1.8. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.8&gt;.</changelog>
</package>
<package pkgid="8b7377bf978c2f179878bce11bbe8c80d60d9b7a5bcccfdff7e8a65514debb89" name="runc" arch="aarch64">
  <version epoch="0" ver="1.1.9" rel="150000.52.2"/>
  <changelog author="asarai@suse.com" date="1620820800">- Update to runc v1.0.0~rc94. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94
  Breaking Changes:
  * cgroupv1: kernel memory limits are now always ignored, as kmemcg has
    been effectively deprecated by the kernel. Users should make use of regular
    memory cgroup controls.
  Regression Fixes:
  * seccomp: fix 32-bit compilation errors
  * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code
  * runc start: fix "chdir to cwd: permission denied" for some setups
- Remove upstreamed patches:
  - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1621425600">- Update to runc v1.0.0~rc95. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95
  This release of runc contains a fix for CVE-2021-30465, and users are
  strongly recommended to update (especially if you are providing
  semi-limited access to spawn containers to untrusted users). bsc#1185405</changelog>
  <changelog author="asarai@suse.com" date="1622548800">- Update to runc v1.0.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0
  ! The usage of relative paths for mountpoints will now produce a warning
    (such configurations are outside of the spec, and in future runc will
    produce an error when given such configurations).
  * cgroupv2: devices: rework the filter generation to produce consistent
    results with cgroupv1, and always clobber any existing eBPF
    program(s) to fix runc update and avoid leaking eBPF programs
    (resulting in errors when managing containers).
  * cgroupv2: correctly convert "number of IOs" statistics in a
    cgroupv1-compatible way.
  * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.
  * cgroupv2: wait for freeze to finish before returning from the freezing
    code, optimize the method for checking whether a cgroup is frozen.
  * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94
  * cgroups/systemd: fixed returning "unit already exists" error from a systemd
    cgroup manager (regression in rc94)
  + cgroupv2: support SkipDevices with systemd driver
  + cgroup/systemd: return, not ignore, stop unit error from Destroy
  + Make "runc --version" output sane even when built with go get or
    otherwise outside of our build scripts.
  + cgroups: set SkipDevices during runc update (so we don't modify
    cgroups at all during runc update).
  + cgroup1: blkio: support BFQ weights.
  + cgroupv2: set per-device io weights if BFQ IO scheduler is available.</changelog>
  <changelog author="asarai@suse.com" date="1625140800">- Backport &lt;https://github.com/opencontainers/runc/pull/3055&gt; to fix issues
  with runc under openSUSE MicroOS's SELinux policy. boo#1187704
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1626609600">- Update to runc v1.0.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.1
  * Fixed occasional runc exec/run failure ("interrupted system call") on an
    Azure volume.
  * Fixed "unable to find groups ... token too long" error with /etc/group
    containing lines longer than 64K characters.
  * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is
    frozen. This is a regression in 1.0.0, not affecting runc itself but some
    of libcontainer users (e.g Kubernetes).
  * cgroupv2: bpf: Ignore inaccessible existing programs in case of
    permission error when handling replacement of existing bpf cgroup
    programs. This fixes a regression in 1.0.0, where some SELinux
    policies would block runc from being able to run entirely.
  * cgroup/systemd/v2: don't freeze cgroup on Set.
  * cgroup/systemd/v1: avoid unnecessary freeze on Set.
- Remove upstreamed patches:
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1629720000">- Update to runc v1.0.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.2
  * Fixed a failure to set CPU quota period in some cases on cgroup v1.
  * Fixed the inability to start a container with the "adding seccomp filter
    rule for syscall ..." error, caused by redundant seccomp rules (i.e. those
    that has action equal to the default one). Such redundant rules are now
    skipped.
  * Made release builds reproducible from now on.
  * Fixed a rare debug log race in runc init, which can result in occasional
    harmful "failed to decode ..." errors from runc run or exec.
  * Fixed the check in cgroup v1 systemd manager if a container needs to be
    frozen before Set, and add a setting to skip such freeze unconditionally.
    The previous fix for that issue, done in runc 1.0.1, was not working.</changelog>
  <changelog author="asarai@suse.com" date="1638792000">- Update to runc v1.0.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784
  bsc#1193436
  * A potential vulnerability was discovered in runc (related to an internal
    usage of netlink), however upon further investigation we discovered that
    while this bug was exploitable on the master branch of runc, no released
    version of runc could be exploited using this bug. The exploit required
    being able to create a netlink attribute with a length that would overflow a
    uint16 but this was not possible in any released version of runc. For more
    information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784.
    Due to an abundance of caution we decided to do an emergency release with
    this fix, but to reiterate we do not believe this vulnerability was
    possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for
    discovering and reporting this vulnerability so quickly.
  * Fixed inability to start a container with read-write bind mount of a
    read-only fuse host mount.
  * Fixed inability to start when read-only /dev in set in spec.
  * Fixed not removing sub-cgroups upon container delete, when rootless cgroup
    v2 is used with older systemd.
  * Fixed returning error from GetStats when hugetlb is unsupported (which
    causes excessive logging for kubernetes).</changelog>
  <changelog author="asarai@suse.com" date="1639483200">- Update to runc v1.1.0~rc1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.
  + Add support for RDMA cgroup added in Linux 4.11.
  * runc exec now produces exit code of 255 when the exec failed.
    This may help in distinguishing between runc exec failures
    (such as invalid options, non-running container or non-existent
    binary etc.) and failures of the command being executed.
  + runc run: new --keep option to skip removal exited containers artefacts.
    This might be useful to check the state (e.g. of cgroup controllers) after
    the container has￼exited.
  + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
    (the latter is just an alias for SCMP_ACT_KILL).
  + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
    users to create sophisticated seccomp filters where syscalls can be
    efficiently emulated by privileged processes on the host.
  + checkpoint/restore: add an option (--lsm-mount-context) to set
    a different LSM mount context on restore.
  + intelrdt: support ClosID parameter.
  + runc exec --cgroup: an option to specify a (non-top) in-container cgroup
    to use for the process being executed.
  + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
    machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
    run/exec now adds the container to the appropriate cgroup under it).
  + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
    behaviour.
  + mounts: add support for bind-mounts which are inaccessible after switching
    the user namespace. Note that this does not permit the container any
    additional access to the host filesystem, it simply allows containers to
    have bind-mounts configured for paths the user can access but have
    restrictive access control settings for other users.
  + Add support for recursive mount attributes using mount_setattr(2). These
    have the same names as the proposed mount(8) options -- just prepend r
    to the option name (such as rro).
  + Add runc features subcommand to allow runc users to detect what features
    runc has been built with. This includes critical information such as
    supported mount flags, hook names, and so on. Note that the output of this
    command is subject to change and will not be considered stable until runc
    1.2 at the earliest. The runtime-spec specification for this feature is
    being developed in opencontainers/runtime-spec#1130.
  * system: improve performance of /proc/$pid/stat parsing.
  * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
    the ownership of certain cgroup control files (as per
    /sys/kernel/cgroup/delegate) to allow for proper deferral to the container
    process.
  * runc checkpoint/restore: fixed for containers with an external bind mount
    which destination is a symlink.
  * cgroup: improve openat2 handling for cgroup directory handle hardening.
    runc delete -f now succeeds (rather than timing out) on a paused
    container.
  * runc run/start/exec now refuses a frozen cgroup (paused container in case of
    exec). Users can disable this using --ignore-paused.
- Update version data embedded in binary to correctly include the git commit of
  the release.
- Drop runc-rpmlintrc because we don't have runc-test anymore.</changelog>
  <changelog author="asarai@suse.com" date="1642420800">- Update to runc v1.1.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0.
  - libcontainer will now refuse to build without the nsenter package being
    correctly compiled (specifically this requires CGO to be enabled). This
    should avoid folks accidentally creating broken runc binaries (and
    incorrectly importing our internal libraries into their projects). (#3331)</changelog>
  <changelog author="asarai@suse.com" date="1648555200">- Update to runc v1.1.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.1.
  * runc run/start can now run a container with read-only /dev in OCI spec,
    rather than error out. (#3355)
  * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)
    libcontainer systemd v2 manager no longer errors out if one of the files
    listed in /sys/kernel/cgroup/delegate do not exist in container's
    cgroup. (#3387, #3404)
  * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported"
    error. (#3406)
  * libcontainer/cgroups no longer panics in cgroup v1 managers if stat
    of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)</changelog>
  <changelog author="asarai@suse.com" date="1652270400">- Update to runc v1.1.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.2.
  CVE-2022-29162 bsc#1199460
  * A bug was found in runc where runc exec --cap executed processes with
    non-empty inheritable Linux process capabilities, creating an atypical Linux
    environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and
    CVE-2022-29162. bsc#1199460
  * `runc spec` no longer sets any inheritable capabilities in the created
    example OCI spec (`config.json`) file.</changelog>
  <changelog author="asarai@suse.com" date="1652356800">- Add ExcludeArch for s390 (not s390x) since we've never supported it.</changelog>
  <changelog author="asarai@suse.com" date="1653307200">- Backport &lt;https://github.com/opencontainers/runc/pull/3474&gt; to fix issues
  with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by
  that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565
  + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="asarai@suse.com" date="1654776000">- Update to runc v1.1.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.3.
  (Includes a fix for bsc#1200088.)
  * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on
    s390 and s390x. This solves the issue where syscalls the host kernel did not
    support would return `-EPERM` despite the existence of the `-ENOSYS` stub
    code (this was due to how s390x does syscall multiplexing).
  * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as
    intended; this fix does not affect runc binary itself but is important for
    libcontainer users such as Kubernetes.
  * Inability to compile with recent clang due to an issue with duplicate
    constants in libseccomp-golang.
  * When using systemd cgroup driver, skip adding device paths that don't exist,
    to stop systemd from emitting warnings about those paths.
  * Socket activation was failing when more than 3 sockets were used.
  * Various CI fixes.
  * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.
  * runc static binaries are now linked against libseccomp v2.5.4.
- Remove upstreamed patches:
  - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="fvogt@suse.com" date="1661947200">- Update to runc v1.1.4. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.4.
  bsc#1202021
  * Fix mounting via wrong proc fd. When the user and mount namespaces are
    used, and the bind mount is followed by the cgroup mount in the spec,
    the cgroup was mounted using the bind mount's mount fd.
  * Switch kill() in libcontainer/nsenter to sane_kill().
  * Fix "permission denied" error from runc run on noexec fs.
  * Fix failed exec after systemctl daemon-reload. Due to a regression
    in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and
    was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.
    (boo#1202821)</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to runc v1.1.5. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.5&gt;.
  Includes fixes for the following CVEs:
  - CVE-2023-25809 bsc#1209884
  - CVE-2023-27561 bsc#1208962
  - CVE-2023-28642 bsc#1209888
  * Fix the inability to use `/dev/null` when inside a container. bsc#1168481
  * Fix changing the ownership of host's `/dev/null` caused by fd redirection
    (a regression in 1.1.1). bsc#1207004
  * Fix rare runc exec/enter unshare error on older kernels.
  * nsexec: Check for errors in `write_log()`.
- Drop version-specific Go requirement.</changelog>
  <changelog author="asarai@suse.com" date="1681300800">- Update to runc v1.1.6. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.6&gt;.</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to runc v1.1.7. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.7&gt;.
- Update runc.keyring to upstream version.</changelog>
  <changelog author="asarai@suse.com" date="1689768000">- Update to runc v1.1.8. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.8&gt;.</changelog>
  <changelog author="danish.prakash@suse.com" date="1694001600">- Update to runc v1.1.9. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.9&gt;.</changelog>
</package>
<package pkgid="2dd425528a08e7badd9fe0e7ca80041c7a5333f21a3156faeed0c37ce365e8cb" name="runc" arch="s390x">
  <version epoch="0" ver="1.1.9" rel="150000.52.2"/>
  <changelog author="asarai@suse.com" date="1620820800">- Update to runc v1.0.0~rc94. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94
  Breaking Changes:
  * cgroupv1: kernel memory limits are now always ignored, as kmemcg has
    been effectively deprecated by the kernel. Users should make use of regular
    memory cgroup controls.
  Regression Fixes:
  * seccomp: fix 32-bit compilation errors
  * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code
  * runc start: fix "chdir to cwd: permission denied" for some setups
- Remove upstreamed patches:
  - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1621425600">- Update to runc v1.0.0~rc95. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95
  This release of runc contains a fix for CVE-2021-30465, and users are
  strongly recommended to update (especially if you are providing
  semi-limited access to spawn containers to untrusted users). bsc#1185405</changelog>
  <changelog author="asarai@suse.com" date="1622548800">- Update to runc v1.0.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0
  ! The usage of relative paths for mountpoints will now produce a warning
    (such configurations are outside of the spec, and in future runc will
    produce an error when given such configurations).
  * cgroupv2: devices: rework the filter generation to produce consistent
    results with cgroupv1, and always clobber any existing eBPF
    program(s) to fix runc update and avoid leaking eBPF programs
    (resulting in errors when managing containers).
  * cgroupv2: correctly convert "number of IOs" statistics in a
    cgroupv1-compatible way.
  * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.
  * cgroupv2: wait for freeze to finish before returning from the freezing
    code, optimize the method for checking whether a cgroup is frozen.
  * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94
  * cgroups/systemd: fixed returning "unit already exists" error from a systemd
    cgroup manager (regression in rc94)
  + cgroupv2: support SkipDevices with systemd driver
  + cgroup/systemd: return, not ignore, stop unit error from Destroy
  + Make "runc --version" output sane even when built with go get or
    otherwise outside of our build scripts.
  + cgroups: set SkipDevices during runc update (so we don't modify
    cgroups at all during runc update).
  + cgroup1: blkio: support BFQ weights.
  + cgroupv2: set per-device io weights if BFQ IO scheduler is available.</changelog>
  <changelog author="asarai@suse.com" date="1625140800">- Backport &lt;https://github.com/opencontainers/runc/pull/3055&gt; to fix issues
  with runc under openSUSE MicroOS's SELinux policy. boo#1187704
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1626609600">- Update to runc v1.0.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.1
  * Fixed occasional runc exec/run failure ("interrupted system call") on an
    Azure volume.
  * Fixed "unable to find groups ... token too long" error with /etc/group
    containing lines longer than 64K characters.
  * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is
    frozen. This is a regression in 1.0.0, not affecting runc itself but some
    of libcontainer users (e.g Kubernetes).
  * cgroupv2: bpf: Ignore inaccessible existing programs in case of
    permission error when handling replacement of existing bpf cgroup
    programs. This fixes a regression in 1.0.0, where some SELinux
    policies would block runc from being able to run entirely.
  * cgroup/systemd/v2: don't freeze cgroup on Set.
  * cgroup/systemd/v1: avoid unnecessary freeze on Set.
- Remove upstreamed patches:
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1629720000">- Update to runc v1.0.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.2
  * Fixed a failure to set CPU quota period in some cases on cgroup v1.
  * Fixed the inability to start a container with the "adding seccomp filter
    rule for syscall ..." error, caused by redundant seccomp rules (i.e. those
    that has action equal to the default one). Such redundant rules are now
    skipped.
  * Made release builds reproducible from now on.
  * Fixed a rare debug log race in runc init, which can result in occasional
    harmful "failed to decode ..." errors from runc run or exec.
  * Fixed the check in cgroup v1 systemd manager if a container needs to be
    frozen before Set, and add a setting to skip such freeze unconditionally.
    The previous fix for that issue, done in runc 1.0.1, was not working.</changelog>
  <changelog author="asarai@suse.com" date="1638792000">- Update to runc v1.0.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784
  bsc#1193436
  * A potential vulnerability was discovered in runc (related to an internal
    usage of netlink), however upon further investigation we discovered that
    while this bug was exploitable on the master branch of runc, no released
    version of runc could be exploited using this bug. The exploit required
    being able to create a netlink attribute with a length that would overflow a
    uint16 but this was not possible in any released version of runc. For more
    information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784.
    Due to an abundance of caution we decided to do an emergency release with
    this fix, but to reiterate we do not believe this vulnerability was
    possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for
    discovering and reporting this vulnerability so quickly.
  * Fixed inability to start a container with read-write bind mount of a
    read-only fuse host mount.
  * Fixed inability to start when read-only /dev in set in spec.
  * Fixed not removing sub-cgroups upon container delete, when rootless cgroup
    v2 is used with older systemd.
  * Fixed returning error from GetStats when hugetlb is unsupported (which
    causes excessive logging for kubernetes).</changelog>
  <changelog author="asarai@suse.com" date="1639483200">- Update to runc v1.1.0~rc1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.
  + Add support for RDMA cgroup added in Linux 4.11.
  * runc exec now produces exit code of 255 when the exec failed.
    This may help in distinguishing between runc exec failures
    (such as invalid options, non-running container or non-existent
    binary etc.) and failures of the command being executed.
  + runc run: new --keep option to skip removal exited containers artefacts.
    This might be useful to check the state (e.g. of cgroup controllers) after
    the container has￼exited.
  + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
    (the latter is just an alias for SCMP_ACT_KILL).
  + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
    users to create sophisticated seccomp filters where syscalls can be
    efficiently emulated by privileged processes on the host.
  + checkpoint/restore: add an option (--lsm-mount-context) to set
    a different LSM mount context on restore.
  + intelrdt: support ClosID parameter.
  + runc exec --cgroup: an option to specify a (non-top) in-container cgroup
    to use for the process being executed.
  + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
    machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
    run/exec now adds the container to the appropriate cgroup under it).
  + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
    behaviour.
  + mounts: add support for bind-mounts which are inaccessible after switching
    the user namespace. Note that this does not permit the container any
    additional access to the host filesystem, it simply allows containers to
    have bind-mounts configured for paths the user can access but have
    restrictive access control settings for other users.
  + Add support for recursive mount attributes using mount_setattr(2). These
    have the same names as the proposed mount(8) options -- just prepend r
    to the option name (such as rro).
  + Add runc features subcommand to allow runc users to detect what features
    runc has been built with. This includes critical information such as
    supported mount flags, hook names, and so on. Note that the output of this
    command is subject to change and will not be considered stable until runc
    1.2 at the earliest. The runtime-spec specification for this feature is
    being developed in opencontainers/runtime-spec#1130.
  * system: improve performance of /proc/$pid/stat parsing.
  * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
    the ownership of certain cgroup control files (as per
    /sys/kernel/cgroup/delegate) to allow for proper deferral to the container
    process.
  * runc checkpoint/restore: fixed for containers with an external bind mount
    which destination is a symlink.
  * cgroup: improve openat2 handling for cgroup directory handle hardening.
    runc delete -f now succeeds (rather than timing out) on a paused
    container.
  * runc run/start/exec now refuses a frozen cgroup (paused container in case of
    exec). Users can disable this using --ignore-paused.
- Update version data embedded in binary to correctly include the git commit of
  the release.
- Drop runc-rpmlintrc because we don't have runc-test anymore.</changelog>
  <changelog author="asarai@suse.com" date="1642420800">- Update to runc v1.1.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0.
  - libcontainer will now refuse to build without the nsenter package being
    correctly compiled (specifically this requires CGO to be enabled). This
    should avoid folks accidentally creating broken runc binaries (and
    incorrectly importing our internal libraries into their projects). (#3331)</changelog>
  <changelog author="asarai@suse.com" date="1648555200">- Update to runc v1.1.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.1.
  * runc run/start can now run a container with read-only /dev in OCI spec,
    rather than error out. (#3355)
  * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)
    libcontainer systemd v2 manager no longer errors out if one of the files
    listed in /sys/kernel/cgroup/delegate do not exist in container's
    cgroup. (#3387, #3404)
  * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported"
    error. (#3406)
  * libcontainer/cgroups no longer panics in cgroup v1 managers if stat
    of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)</changelog>
  <changelog author="asarai@suse.com" date="1652270400">- Update to runc v1.1.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.2.
  CVE-2022-29162 bsc#1199460
  * A bug was found in runc where runc exec --cap executed processes with
    non-empty inheritable Linux process capabilities, creating an atypical Linux
    environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and
    CVE-2022-29162. bsc#1199460
  * `runc spec` no longer sets any inheritable capabilities in the created
    example OCI spec (`config.json`) file.</changelog>
  <changelog author="asarai@suse.com" date="1652356800">- Add ExcludeArch for s390 (not s390x) since we've never supported it.</changelog>
  <changelog author="asarai@suse.com" date="1653307200">- Backport &lt;https://github.com/opencontainers/runc/pull/3474&gt; to fix issues
  with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by
  that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565
  + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="asarai@suse.com" date="1654776000">- Update to runc v1.1.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.3.
  (Includes a fix for bsc#1200088.)
  * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on
    s390 and s390x. This solves the issue where syscalls the host kernel did not
    support would return `-EPERM` despite the existence of the `-ENOSYS` stub
    code (this was due to how s390x does syscall multiplexing).
  * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as
    intended; this fix does not affect runc binary itself but is important for
    libcontainer users such as Kubernetes.
  * Inability to compile with recent clang due to an issue with duplicate
    constants in libseccomp-golang.
  * When using systemd cgroup driver, skip adding device paths that don't exist,
    to stop systemd from emitting warnings about those paths.
  * Socket activation was failing when more than 3 sockets were used.
  * Various CI fixes.
  * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.
  * runc static binaries are now linked against libseccomp v2.5.4.
- Remove upstreamed patches:
  - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="fvogt@suse.com" date="1661947200">- Update to runc v1.1.4. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.4.
  bsc#1202021
  * Fix mounting via wrong proc fd. When the user and mount namespaces are
    used, and the bind mount is followed by the cgroup mount in the spec,
    the cgroup was mounted using the bind mount's mount fd.
  * Switch kill() in libcontainer/nsenter to sane_kill().
  * Fix "permission denied" error from runc run on noexec fs.
  * Fix failed exec after systemctl daemon-reload. Due to a regression
    in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and
    was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.
    (boo#1202821)</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to runc v1.1.5. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.5&gt;.
  Includes fixes for the following CVEs:
  - CVE-2023-25809 bsc#1209884
  - CVE-2023-27561 bsc#1208962
  - CVE-2023-28642 bsc#1209888
  * Fix the inability to use `/dev/null` when inside a container. bsc#1168481
  * Fix changing the ownership of host's `/dev/null` caused by fd redirection
    (a regression in 1.1.1). bsc#1207004
  * Fix rare runc exec/enter unshare error on older kernels.
  * nsexec: Check for errors in `write_log()`.
- Drop version-specific Go requirement.</changelog>
  <changelog author="asarai@suse.com" date="1681300800">- Update to runc v1.1.6. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.6&gt;.</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to runc v1.1.7. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.7&gt;.
- Update runc.keyring to upstream version.</changelog>
  <changelog author="asarai@suse.com" date="1689768000">- Update to runc v1.1.8. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.8&gt;.</changelog>
  <changelog author="danish.prakash@suse.com" date="1694001600">- Update to runc v1.1.9. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.9&gt;.</changelog>
</package>
<package pkgid="6a8b25ae2fc95e24f5c35186e4bd0e5df933338110ec274d629b57b38f08b4f6" name="runc" arch="src">
  <version epoch="0" ver="1.1.9" rel="150000.52.2"/>
  <changelog author="asarai@suse.com" date="1620820800">- Update to runc v1.0.0~rc94. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94
  Breaking Changes:
  * cgroupv1: kernel memory limits are now always ignored, as kmemcg has
    been effectively deprecated by the kernel. Users should make use of regular
    memory cgroup controls.
  Regression Fixes:
  * seccomp: fix 32-bit compilation errors
  * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code
  * runc start: fix "chdir to cwd: permission denied" for some setups
- Remove upstreamed patches:
  - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1621425600">- Update to runc v1.0.0~rc95. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95
  This release of runc contains a fix for CVE-2021-30465, and users are
  strongly recommended to update (especially if you are providing
  semi-limited access to spawn containers to untrusted users). bsc#1185405</changelog>
  <changelog author="asarai@suse.com" date="1622548800">- Update to runc v1.0.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0
  ! The usage of relative paths for mountpoints will now produce a warning
    (such configurations are outside of the spec, and in future runc will
    produce an error when given such configurations).
  * cgroupv2: devices: rework the filter generation to produce consistent
    results with cgroupv1, and always clobber any existing eBPF
    program(s) to fix runc update and avoid leaking eBPF programs
    (resulting in errors when managing containers).
  * cgroupv2: correctly convert "number of IOs" statistics in a
    cgroupv1-compatible way.
  * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.
  * cgroupv2: wait for freeze to finish before returning from the freezing
    code, optimize the method for checking whether a cgroup is frozen.
  * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94
  * cgroups/systemd: fixed returning "unit already exists" error from a systemd
    cgroup manager (regression in rc94)
  + cgroupv2: support SkipDevices with systemd driver
  + cgroup/systemd: return, not ignore, stop unit error from Destroy
  + Make "runc --version" output sane even when built with go get or
    otherwise outside of our build scripts.
  + cgroups: set SkipDevices during runc update (so we don't modify
    cgroups at all during runc update).
  + cgroup1: blkio: support BFQ weights.
  + cgroupv2: set per-device io weights if BFQ IO scheduler is available.</changelog>
  <changelog author="asarai@suse.com" date="1625140800">- Backport &lt;https://github.com/opencontainers/runc/pull/3055&gt; to fix issues
  with runc under openSUSE MicroOS's SELinux policy. boo#1187704
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1626609600">- Update to runc v1.0.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.1
  * Fixed occasional runc exec/run failure ("interrupted system call") on an
    Azure volume.
  * Fixed "unable to find groups ... token too long" error with /etc/group
    containing lines longer than 64K characters.
  * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is
    frozen. This is a regression in 1.0.0, not affecting runc itself but some
    of libcontainer users (e.g Kubernetes).
  * cgroupv2: bpf: Ignore inaccessible existing programs in case of
    permission error when handling replacement of existing bpf cgroup
    programs. This fixes a regression in 1.0.0, where some SELinux
    policies would block runc from being able to run entirely.
  * cgroup/systemd/v2: don't freeze cgroup on Set.
  * cgroup/systemd/v1: avoid unnecessary freeze on Set.
- Remove upstreamed patches:
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1629720000">- Update to runc v1.0.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.2
  * Fixed a failure to set CPU quota period in some cases on cgroup v1.
  * Fixed the inability to start a container with the "adding seccomp filter
    rule for syscall ..." error, caused by redundant seccomp rules (i.e. those
    that has action equal to the default one). Such redundant rules are now
    skipped.
  * Made release builds reproducible from now on.
  * Fixed a rare debug log race in runc init, which can result in occasional
    harmful "failed to decode ..." errors from runc run or exec.
  * Fixed the check in cgroup v1 systemd manager if a container needs to be
    frozen before Set, and add a setting to skip such freeze unconditionally.
    The previous fix for that issue, done in runc 1.0.1, was not working.</changelog>
  <changelog author="asarai@suse.com" date="1638792000">- Update to runc v1.0.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784
  bsc#1193436
  * A potential vulnerability was discovered in runc (related to an internal
    usage of netlink), however upon further investigation we discovered that
    while this bug was exploitable on the master branch of runc, no released
    version of runc could be exploited using this bug. The exploit required
    being able to create a netlink attribute with a length that would overflow a
    uint16 but this was not possible in any released version of runc. For more
    information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784.
    Due to an abundance of caution we decided to do an emergency release with
    this fix, but to reiterate we do not believe this vulnerability was
    possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for
    discovering and reporting this vulnerability so quickly.
  * Fixed inability to start a container with read-write bind mount of a
    read-only fuse host mount.
  * Fixed inability to start when read-only /dev in set in spec.
  * Fixed not removing sub-cgroups upon container delete, when rootless cgroup
    v2 is used with older systemd.
  * Fixed returning error from GetStats when hugetlb is unsupported (which
    causes excessive logging for kubernetes).</changelog>
  <changelog author="asarai@suse.com" date="1639483200">- Update to runc v1.1.0~rc1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.
  + Add support for RDMA cgroup added in Linux 4.11.
  * runc exec now produces exit code of 255 when the exec failed.
    This may help in distinguishing between runc exec failures
    (such as invalid options, non-running container or non-existent
    binary etc.) and failures of the command being executed.
  + runc run: new --keep option to skip removal exited containers artefacts.
    This might be useful to check the state (e.g. of cgroup controllers) after
    the container has￼exited.
  + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
    (the latter is just an alias for SCMP_ACT_KILL).
  + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
    users to create sophisticated seccomp filters where syscalls can be
    efficiently emulated by privileged processes on the host.
  + checkpoint/restore: add an option (--lsm-mount-context) to set
    a different LSM mount context on restore.
  + intelrdt: support ClosID parameter.
  + runc exec --cgroup: an option to specify a (non-top) in-container cgroup
    to use for the process being executed.
  + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
    machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
    run/exec now adds the container to the appropriate cgroup under it).
  + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
    behaviour.
  + mounts: add support for bind-mounts which are inaccessible after switching
    the user namespace. Note that this does not permit the container any
    additional access to the host filesystem, it simply allows containers to
    have bind-mounts configured for paths the user can access but have
    restrictive access control settings for other users.
  + Add support for recursive mount attributes using mount_setattr(2). These
    have the same names as the proposed mount(8) options -- just prepend r
    to the option name (such as rro).
  + Add runc features subcommand to allow runc users to detect what features
    runc has been built with. This includes critical information such as
    supported mount flags, hook names, and so on. Note that the output of this
    command is subject to change and will not be considered stable until runc
    1.2 at the earliest. The runtime-spec specification for this feature is
    being developed in opencontainers/runtime-spec#1130.
  * system: improve performance of /proc/$pid/stat parsing.
  * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
    the ownership of certain cgroup control files (as per
    /sys/kernel/cgroup/delegate) to allow for proper deferral to the container
    process.
  * runc checkpoint/restore: fixed for containers with an external bind mount
    which destination is a symlink.
  * cgroup: improve openat2 handling for cgroup directory handle hardening.
    runc delete -f now succeeds (rather than timing out) on a paused
    container.
  * runc run/start/exec now refuses a frozen cgroup (paused container in case of
    exec). Users can disable this using --ignore-paused.
- Update version data embedded in binary to correctly include the git commit of
  the release.
- Drop runc-rpmlintrc because we don't have runc-test anymore.</changelog>
  <changelog author="asarai@suse.com" date="1642420800">- Update to runc v1.1.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0.
  - libcontainer will now refuse to build without the nsenter package being
    correctly compiled (specifically this requires CGO to be enabled). This
    should avoid folks accidentally creating broken runc binaries (and
    incorrectly importing our internal libraries into their projects). (#3331)</changelog>
  <changelog author="asarai@suse.com" date="1648555200">- Update to runc v1.1.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.1.
  * runc run/start can now run a container with read-only /dev in OCI spec,
    rather than error out. (#3355)
  * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)
    libcontainer systemd v2 manager no longer errors out if one of the files
    listed in /sys/kernel/cgroup/delegate do not exist in container's
    cgroup. (#3387, #3404)
  * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported"
    error. (#3406)
  * libcontainer/cgroups no longer panics in cgroup v1 managers if stat
    of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)</changelog>
  <changelog author="asarai@suse.com" date="1652270400">- Update to runc v1.1.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.2.
  CVE-2022-29162 bsc#1199460
  * A bug was found in runc where runc exec --cap executed processes with
    non-empty inheritable Linux process capabilities, creating an atypical Linux
    environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and
    CVE-2022-29162. bsc#1199460
  * `runc spec` no longer sets any inheritable capabilities in the created
    example OCI spec (`config.json`) file.</changelog>
  <changelog author="asarai@suse.com" date="1652356800">- Add ExcludeArch for s390 (not s390x) since we've never supported it.</changelog>
  <changelog author="asarai@suse.com" date="1653307200">- Backport &lt;https://github.com/opencontainers/runc/pull/3474&gt; to fix issues
  with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by
  that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565
  + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="asarai@suse.com" date="1654776000">- Update to runc v1.1.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.3.
  (Includes a fix for bsc#1200088.)
  * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on
    s390 and s390x. This solves the issue where syscalls the host kernel did not
    support would return `-EPERM` despite the existence of the `-ENOSYS` stub
    code (this was due to how s390x does syscall multiplexing).
  * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as
    intended; this fix does not affect runc binary itself but is important for
    libcontainer users such as Kubernetes.
  * Inability to compile with recent clang due to an issue with duplicate
    constants in libseccomp-golang.
  * When using systemd cgroup driver, skip adding device paths that don't exist,
    to stop systemd from emitting warnings about those paths.
  * Socket activation was failing when more than 3 sockets were used.
  * Various CI fixes.
  * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.
  * runc static binaries are now linked against libseccomp v2.5.4.
- Remove upstreamed patches:
  - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="fvogt@suse.com" date="1661947200">- Update to runc v1.1.4. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.4.
  bsc#1202021
  * Fix mounting via wrong proc fd. When the user and mount namespaces are
    used, and the bind mount is followed by the cgroup mount in the spec,
    the cgroup was mounted using the bind mount's mount fd.
  * Switch kill() in libcontainer/nsenter to sane_kill().
  * Fix "permission denied" error from runc run on noexec fs.
  * Fix failed exec after systemctl daemon-reload. Due to a regression
    in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and
    was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.
    (boo#1202821)</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to runc v1.1.5. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.5&gt;.
  Includes fixes for the following CVEs:
  - CVE-2023-25809 bsc#1209884
  - CVE-2023-27561 bsc#1208962
  - CVE-2023-28642 bsc#1209888
  * Fix the inability to use `/dev/null` when inside a container. bsc#1168481
  * Fix changing the ownership of host's `/dev/null` caused by fd redirection
    (a regression in 1.1.1). bsc#1207004
  * Fix rare runc exec/enter unshare error on older kernels.
  * nsexec: Check for errors in `write_log()`.
- Drop version-specific Go requirement.</changelog>
  <changelog author="asarai@suse.com" date="1681300800">- Update to runc v1.1.6. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.6&gt;.</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to runc v1.1.7. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.7&gt;.
- Update runc.keyring to upstream version.</changelog>
  <changelog author="asarai@suse.com" date="1689768000">- Update to runc v1.1.8. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.8&gt;.</changelog>
  <changelog author="danish.prakash@suse.com" date="1694001600">- Update to runc v1.1.9. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.9&gt;.</changelog>
</package>
<package pkgid="e5d2ac196ce3f17f43afc5cdc10a5306306f1f12136e384b8d2e31ab01517b64" name="runc" arch="x86_64">
  <version epoch="0" ver="1.1.9" rel="150000.52.2"/>
  <changelog author="asarai@suse.com" date="1620820800">- Update to runc v1.0.0~rc94. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc94
  Breaking Changes:
  * cgroupv1: kernel memory limits are now always ignored, as kmemcg has
    been effectively deprecated by the kernel. Users should make use of regular
    memory cgroup controls.
  Regression Fixes:
  * seccomp: fix 32-bit compilation errors
  * runc init: fix a hang caused by deadlock in seccomp/ebpf loading code
  * runc start: fix "chdir to cwd: permission denied" for some setups
- Remove upstreamed patches:
  - 0001-cloned_binary-switch-from-error-to-warning-for-SYS_m.patch</changelog>
  <changelog author="asarai@suse.com" date="1621425600">- Update to runc v1.0.0~rc95. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc95
  This release of runc contains a fix for CVE-2021-30465, and users are
  strongly recommended to update (especially if you are providing
  semi-limited access to spawn containers to untrusted users). bsc#1185405</changelog>
  <changelog author="asarai@suse.com" date="1622548800">- Update to runc v1.0.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.0
  ! The usage of relative paths for mountpoints will now produce a warning
    (such configurations are outside of the spec, and in future runc will
    produce an error when given such configurations).
  * cgroupv2: devices: rework the filter generation to produce consistent
    results with cgroupv1, and always clobber any existing eBPF
    program(s) to fix runc update and avoid leaking eBPF programs
    (resulting in errors when managing containers).
  * cgroupv2: correctly convert "number of IOs" statistics in a
    cgroupv1-compatible way.
  * cgroupv2: support larger than 32-bit IO statistics on 32-bit architectures.
  * cgroupv2: wait for freeze to finish before returning from the freezing
    code, optimize the method for checking whether a cgroup is frozen.
  * cgroups/systemd: fixed "retry on dbus disconnect" logic introduced in rc94
  * cgroups/systemd: fixed returning "unit already exists" error from a systemd
    cgroup manager (regression in rc94)
  + cgroupv2: support SkipDevices with systemd driver
  + cgroup/systemd: return, not ignore, stop unit error from Destroy
  + Make "runc --version" output sane even when built with go get or
    otherwise outside of our build scripts.
  + cgroups: set SkipDevices during runc update (so we don't modify
    cgroups at all during runc update).
  + cgroup1: blkio: support BFQ weights.
  + cgroupv2: set per-device io weights if BFQ IO scheduler is available.</changelog>
  <changelog author="asarai@suse.com" date="1625140800">- Backport &lt;https://github.com/opencontainers/runc/pull/3055&gt; to fix issues
  with runc under openSUSE MicroOS's SELinux policy. boo#1187704
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1626609600">- Update to runc v1.0.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.1
  * Fixed occasional runc exec/run failure ("interrupted system call") on an
    Azure volume.
  * Fixed "unable to find groups ... token too long" error with /etc/group
    containing lines longer than 64K characters.
  * cgroup/systemd/v1: fix leaving cgroup frozen after Set if a parent cgroup is
    frozen. This is a regression in 1.0.0, not affecting runc itself but some
    of libcontainer users (e.g Kubernetes).
  * cgroupv2: bpf: Ignore inaccessible existing programs in case of
    permission error when handling replacement of existing bpf cgroup
    programs. This fixes a regression in 1.0.0, where some SELinux
    policies would block runc from being able to run entirely.
  * cgroup/systemd/v2: don't freeze cgroup on Set.
  * cgroup/systemd/v1: avoid unnecessary freeze on Set.
- Remove upstreamed patches:
  + boo1187704-0001-cgroupv2-ebpf-ignore-inaccessible-existing-programs.patch</changelog>
  <changelog author="asarai@suse.com" date="1629720000">- Update to runc v1.0.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.2
  * Fixed a failure to set CPU quota period in some cases on cgroup v1.
  * Fixed the inability to start a container with the "adding seccomp filter
    rule for syscall ..." error, caused by redundant seccomp rules (i.e. those
    that has action equal to the default one). Such redundant rules are now
    skipped.
  * Made release builds reproducible from now on.
  * Fixed a rare debug log race in runc init, which can result in occasional
    harmful "failed to decode ..." errors from runc run or exec.
  * Fixed the check in cgroup v1 systemd manager if a container needs to be
    frozen before Set, and add a setting to skip such freeze unconditionally.
    The previous fix for that issue, done in runc 1.0.1, was not working.</changelog>
  <changelog author="asarai@suse.com" date="1638792000">- Update to runc v1.0.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784
  bsc#1193436
  * A potential vulnerability was discovered in runc (related to an internal
    usage of netlink), however upon further investigation we discovered that
    while this bug was exploitable on the master branch of runc, no released
    version of runc could be exploited using this bug. The exploit required
    being able to create a netlink attribute with a length that would overflow a
    uint16 but this was not possible in any released version of runc. For more
    information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784.
    Due to an abundance of caution we decided to do an emergency release with
    this fix, but to reiterate we do not believe this vulnerability was
    possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for
    discovering and reporting this vulnerability so quickly.
  * Fixed inability to start a container with read-write bind mount of a
    read-only fuse host mount.
  * Fixed inability to start when read-only /dev in set in spec.
  * Fixed not removing sub-cgroups upon container delete, when rootless cgroup
    v2 is used with older systemd.
  * Fixed returning error from GetStats when hugetlb is unsupported (which
    causes excessive logging for kubernetes).</changelog>
  <changelog author="asarai@suse.com" date="1639483200">- Update to runc v1.1.0~rc1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0-rc.1.
  + Add support for RDMA cgroup added in Linux 4.11.
  * runc exec now produces exit code of 255 when the exec failed.
    This may help in distinguishing between runc exec failures
    (such as invalid options, non-running container or non-existent
    binary etc.) and failures of the command being executed.
  + runc run: new --keep option to skip removal exited containers artefacts.
    This might be useful to check the state (e.g. of cgroup controllers) after
    the container has￼exited.
  + seccomp: add support for SCMP_ACT_KILL_PROCESS and SCMP_ACT_KILL_THREAD
    (the latter is just an alias for SCMP_ACT_KILL).
  + seccomp: add support for SCMP_ACT_NOTIFY (seccomp actions). This allows
    users to create sophisticated seccomp filters where syscalls can be
    efficiently emulated by privileged processes on the host.
  + checkpoint/restore: add an option (--lsm-mount-context) to set
    a different LSM mount context on restore.
  + intelrdt: support ClosID parameter.
  + runc exec --cgroup: an option to specify a (non-top) in-container cgroup
    to use for the process being executed.
  + cgroup v1 controllers now support hybrid hierarchy (i.e. when on a cgroup v1
    machine a cgroup2 filesystem is mounted to /sys/fs/cgroup/unified, runc
    run/exec now adds the container to the appropriate cgroup under it).
  + sysctl: allow slashes in sysctl names, to better match sysctl(8)'s
    behaviour.
  + mounts: add support for bind-mounts which are inaccessible after switching
    the user namespace. Note that this does not permit the container any
    additional access to the host filesystem, it simply allows containers to
    have bind-mounts configured for paths the user can access but have
    restrictive access control settings for other users.
  + Add support for recursive mount attributes using mount_setattr(2). These
    have the same names as the proposed mount(8) options -- just prepend r
    to the option name (such as rro).
  + Add runc features subcommand to allow runc users to detect what features
    runc has been built with. This includes critical information such as
    supported mount flags, hook names, and so on. Note that the output of this
    command is subject to change and will not be considered stable until runc
    1.2 at the earliest. The runtime-spec specification for this feature is
    being developed in opencontainers/runtime-spec#1130.
  * system: improve performance of /proc/$pid/stat parsing.
  * cgroup2: when /sys/fs/cgroup is configured as a read-write mount, change
    the ownership of certain cgroup control files (as per
    /sys/kernel/cgroup/delegate) to allow for proper deferral to the container
    process.
  * runc checkpoint/restore: fixed for containers with an external bind mount
    which destination is a symlink.
  * cgroup: improve openat2 handling for cgroup directory handle hardening.
    runc delete -f now succeeds (rather than timing out) on a paused
    container.
  * runc run/start/exec now refuses a frozen cgroup (paused container in case of
    exec). Users can disable this using --ignore-paused.
- Update version data embedded in binary to correctly include the git commit of
  the release.
- Drop runc-rpmlintrc because we don't have runc-test anymore.</changelog>
  <changelog author="asarai@suse.com" date="1642420800">- Update to runc v1.1.0. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.0.
  - libcontainer will now refuse to build without the nsenter package being
    correctly compiled (specifically this requires CGO to be enabled). This
    should avoid folks accidentally creating broken runc binaries (and
    incorrectly importing our internal libraries into their projects). (#3331)</changelog>
  <changelog author="asarai@suse.com" date="1648555200">- Update to runc v1.1.1. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.1.
  * runc run/start can now run a container with read-only /dev in OCI spec,
    rather than error out. (#3355)
  * runc exec now ensures that --cgroup argument is a sub-cgroup. (#3403)
    libcontainer systemd v2 manager no longer errors out if one of the files
    listed in /sys/kernel/cgroup/delegate do not exist in container's
    cgroup. (#3387, #3404)
  * Loosen OCI spec validation to avoid bogus "Intel RDT is not supported"
    error. (#3406)
  * libcontainer/cgroups no longer panics in cgroup v1 managers if stat
    of /sys/fs/cgroup/unified returns an error other than ENOENT. (#3435)</changelog>
  <changelog author="asarai@suse.com" date="1652270400">- Update to runc v1.1.2. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.2.
  CVE-2022-29162 bsc#1199460
  * A bug was found in runc where runc exec --cap executed processes with
    non-empty inheritable Linux process capabilities, creating an atypical Linux
    environment. For more information, see [GHSA-f3fp-gc8g-vw66][] and
    CVE-2022-29162. bsc#1199460
  * `runc spec` no longer sets any inheritable capabilities in the created
    example OCI spec (`config.json`) file.</changelog>
  <changelog author="asarai@suse.com" date="1652356800">- Add ExcludeArch for s390 (not s390x) since we've never supported it.</changelog>
  <changelog author="asarai@suse.com" date="1653307200">- Backport &lt;https://github.com/opencontainers/runc/pull/3474&gt; to fix issues
  with newer syscalls (namely faccessat2) on older kernels on s390(x) caused by
  that platform's syscall multiplexing semantics. bsc#1192051 bsc#1199565
  + bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="asarai@suse.com" date="1654776000">- Update to runc v1.1.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.3.
  (Includes a fix for bsc#1200088.)
  * Our seccomp `-ENOSYS` stub now correctly handles multiplexed syscalls on
    s390 and s390x. This solves the issue where syscalls the host kernel did not
    support would return `-EPERM` despite the existence of the `-ENOSYS` stub
    code (this was due to how s390x does syscall multiplexing).
  * Retry on dbus disconnect logic in libcontainer/cgroups/systemd now works as
    intended; this fix does not affect runc binary itself but is important for
    libcontainer users such as Kubernetes.
  * Inability to compile with recent clang due to an issue with duplicate
    constants in libseccomp-golang.
  * When using systemd cgroup driver, skip adding device paths that don't exist,
    to stop systemd from emitting warnings about those paths.
  * Socket activation was failing when more than 3 sockets were used.
  * Various CI fixes.
  * Allow to bind mount /proc/sys/kernel/ns_last_pid to inside container.
  * runc static binaries are now linked against libseccomp v2.5.4.
- Remove upstreamed patches:
  - bsc1192051-0001-seccomp-enosys-always-return-ENOSYS-for-setup-2-on-s390x.patch</changelog>
  <changelog author="fvogt@suse.com" date="1661947200">- Update to runc v1.1.4. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.1.4.
  bsc#1202021
  * Fix mounting via wrong proc fd. When the user and mount namespaces are
    used, and the bind mount is followed by the cgroup mount in the spec,
    the cgroup was mounted using the bind mount's mount fd.
  * Switch kill() in libcontainer/nsenter to sane_kill().
  * Fix "permission denied" error from runc run on noexec fs.
  * Fix failed exec after systemctl daemon-reload. Due to a regression
    in v1.1.3, the DeviceAllow=char-pts rwm rule was no longer added and
    was causing an error open /dev/pts/0: operation not permitted: unknown when systemd was reloaded.
    (boo#1202821)</changelog>
  <changelog author="asarai@suse.com" date="1680091200">- Update to runc v1.1.5. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.5&gt;.
  Includes fixes for the following CVEs:
  - CVE-2023-25809 bsc#1209884
  - CVE-2023-27561 bsc#1208962
  - CVE-2023-28642 bsc#1209888
  * Fix the inability to use `/dev/null` when inside a container. bsc#1168481
  * Fix changing the ownership of host's `/dev/null` caused by fd redirection
    (a regression in 1.1.1). bsc#1207004
  * Fix rare runc exec/enter unshare error on older kernels.
  * nsexec: Check for errors in `write_log()`.
- Drop version-specific Go requirement.</changelog>
  <changelog author="asarai@suse.com" date="1681300800">- Update to runc v1.1.6. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.6&gt;.</changelog>
  <changelog author="asarai@suse.com" date="1682596800">- Update to runc v1.1.7. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.7&gt;.
- Update runc.keyring to upstream version.</changelog>
  <changelog author="asarai@suse.com" date="1689768000">- Update to runc v1.1.8. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.8&gt;.</changelog>
  <changelog author="danish.prakash@suse.com" date="1694001600">- Update to runc v1.1.9. Upstream changelog is available from
  &lt;https://github.com/opencontainers/runc/releases/tag/v1.1.9&gt;.</changelog>
</package>
<package pkgid="ffc7960a76869ce8825f6df8c164f06933ad4813b4aa89de474b0a8d0e49a58b" name="samba" arch="src">
  <version epoch="0" ver="4.17.9+git.421.abde31ca5c2" rel="150500.3.11.1"/>
  <changelog author="nopower@suse.com" date="1664452800">- Update to 4.15.10
  * Possible use after free of connection_struct when iterating
    smbd_server_connection-&gt;connections; (bso#15128);
    (bsc#1200102).
  * smbXsrv_connection_shutdown_send result leaked; (bso#15174).
  * Spotlight RPC service returns wrong response when Spotlight
    is disabled on a share; (bso#15086).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1;
    (bso#15153).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * Missing READ_LEASE break could cause data corruption;
    (bso#15148).
  * rpcclient can crash using setuserinfo(2); (bso#15124).
  * Samba fails to build with glibc 2.36 caused by including
    &lt;sys/mount.h&gt; in libreplace; (bso#15132).
  * SMB1 negotiation can fail to handle connection errors;
    (bso#15152).
  * samba-tool domain join segfault when joining a samba ad
    domain; (bso#15078).
- Update to 4.15.9
  * CVE-2022-32742:SMB1 code does not correct verify SMB1write,
    SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
    (bsc#1201496).
  * CVE-2022-32746: samba: Use-after-free occurring in database
    audit logging; (bso#15009); (bso#15096); (bsc#1201490).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1668600000">- Update to 4.15.12
  * CVE-2022-42898: samba: heimdal: Samba buffer overflow
    vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126).
- Update to 4.15.11
  * Allow rebuild of Centos 8 images after move to vault for
    Samba 4.15; (bso#15193).
  * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3();
    (bso#15134); (bsc#1204254)</changelog>
  <changelog author="scabrero@suse.de" date="1669636800">- Install a systemd drop-in file for named service to allow
  read/write access to the DLZ directory; (bsc#1201689);</changelog>
  <changelog author="dmulder@suse.com" date="1669896000">- Introduce without-smb1-server spec flag; (bsc#1205104);
- Update to 4.17.3
  * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit
    systems; (bsc#1205126); (bso#15203);
- Replace obsolete python-gpgme with python-gpg
  * Upstream replaced it in v4.9.5 -- bso#13728
- Update to 4.17.2
  * CVE-2022-3592 [SECURITY] samba: Wide links protection broken;
    (bso#15207); (bsc#1204499).
  * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal
    unwrap_des3();(bso#15134); (bsc#1204254).
- Update to 4.17.1
  * CVE-2021-20251 [SECURITY] Bad password count not incremented
    atomically; (bso#14611).
  * smbXsrv_connection_shutdown_send result leaked; (bso#15174).
  * Flush on a named stream never completes; (bso#15182).
  * Permission denied calling SMBC_getatr when file not exists;
    (bso#15195).
  * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later
    over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC;
    (bso#15189).
  * pytest: add file removal helpers for TestCaseInTempDir;
    (bso#15191).
  * CVE-2021-20251 [SECURITY] Bad password count not incremented
    atomically; (bso#14611).
  * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later
    over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC;
    (bso#15189).
  * Flush on a named stream never completes; (bso#15182).
  * vfs_gpfs silently garbles timestamps &gt; year 2106;
    (bso#15151).
  * CVE-2021-20251 [SECURITY] Bad password count not incremented
    atomically; (bso#14611).
  * multi-channel socket passing may hit a race if one of the
    involved processes already existed; (bso#15200).
  * memory leak on temporary of struct imessaging_post_state and
    struct tevent_immediate on struct imessaging_context (in
    rpcd_spoolss and maybe others); (bso#15201).
  * Since popt1.19 various use after free errors using result of
    poptGetArg are now exposed; (bso#15205); (boo#1204279).
  * Remove special case for O_CREAT in SMB_VFS_OPENAT from
    vfs_glusterfs; (bso#15192).
  * GETPWSID in memory cache grows indefinetly with each NTLM
    auth; (bso#15169).
  * CVE-2021-20251 [SECURITY] Bad password count not incremented
    atomically; (bso#14611).
- Install a systemd drop-in file for named service to allow
  read/write access to the DLZ directory; (bsc#1201689);
- Fix use after free errors resulting from using return of
  poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205).
- s3: smbd: Fix memory leak in
  smbd_server_connection_terminate_done(); (bso#15174).
- Disable SMB1 for tumbleweed builds.
- Update to 4.17.0
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1;
    (bso#15153).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * Cross-node multi-channel reconnects result in SMB2 Negotiate
    returning NT_STATUS_NOT_SUPPORTED; (bso#15159).
  * winbind at info level debug can coredump when processing
    wb_lookupusergroups; (bso#15160).
  * Make use of glfs_*at() API calls in vfs_glusterfs;
    (bso#15157).
  * Possible use after free of connection_struct when iterating
    smbd_server_connection-&gt;connections; (bso#15128).
  * `net usershare add` fails with flag works with --long but
    fails with -l; (bso#15145).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Performance regression on contended path based operations;
    (bso#15125).
  * Missing READ_LEASE break could cause data corruption;
    (bso#15148).
  * libsamba-errors uses a wrong version number; (bso#15141).
  * SMB1 negotiation can fail to handle connection errors;
    (bso#15152).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * 4.17.rc1 still uses symlink-race prone unix_convert();
    (bso#15144).
  * Backport fileserver related changed to 4.17.0rc2;
    (bso#15146).
  * Manpage for smbstatus json is missing; (bso#15147).
  * Backport fileserver related changed to 4.17.0rc2;
    (bso#15146).
  * Performance regression on contended path based operations;
    (bso#15125).
  * Backport fileserver related changed to 4.17.0rc2;
    (bso#15146).
  * Fix issues found by coverity in smbstatus json code;
    (bso#15140).
  * Backport fileserver related changed to 4.17.0rc2;
    (bso#15146).
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Update to 4.16.4
  * CVE-2022-2031: Samba AD users can bypass certain restrictions
    associated with changing passwords; (bsc#1201495); (bso#15047);
  * CVE-2022-32744: Samba AD users can forge password change
    requests for any user; (bsc#1201493); (bso#15074);
  * CVE-2022-32745: Samba AD users can crash the server process
    with an LDAP add or modify request; (bsc#1201492); (bso#15008);
  * CVE-2022-32746: Samba AD users can induce a use-after-free in
    the server process with an LDAP add or modify request;
    (bsc#1201490); (bso#15009);
  * CVE-2022-32742: Server memory information leak via SMB1;
    (bsc#1201496); (bso#15085);
- Update to 4.16.3
  * Using vfs_streams_xattr and deleting a file causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work;
    (bso#15076);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in
    developer mode; (bso#15095);
  * Crash in streams_xattr because fsp-&gt;base_fsp-&gt;fsp_name is
    NULL; (bso#15105);
  * Crash in rpcd_classic - NULL pointer deference in
    mangle_is_mangled(); (bso#15118);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * Fix check for chown when processing NFSv4 ACL; (bso#15120);
  * The pcap background queue process should not be stopped;
    (bso#15082);
  * testparm: Fix typo in idmap rangesize check; (bso#15097);
  * net ads info returns LDAP server and LDAP server name as
    null; (bso#15106);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * CTDB child process logging does not work as expected;
    (bso#15090);
- Update spec file to fix the optional Heimdal DC build
- Fix external trusts with MIT Kerberos 1.20
- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Add sysuser-shadow requirement for packages using
  systemd-sysusers
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Update to 4.16.2
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * Reintroduce netgroups support; (bso#15087);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Update from 4.15  to 4.16 breaks discovery of [homes] on
    standalone server from Win and IOS; (bso#15062);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient -E doesn't work as advertised; (bso#15075);
  * The samba background daemon doesn't refresh the printcap cache
    on startup; (bso#15081);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Fix samba4.blackbox.net_ads_dns_async test with bind9 &gt;= 9.17.7
- Support building with MIT Kerberos 1.20
- Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC;
  (CVE-2020-17049);
- Resource Based Constrained Delegation (RBCD) for Samba AD DC
- Support building with gcc 12.1
- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);
- Update to 4.16.1
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written to;
    (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * Need to describe --builtin-libraries= better (compare with
  - -bundled-libraries); (bso#8731);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * Username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * KVNO off by 100000; (bso#14951);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
- Update update-apparmor-samba-profile script, replace
  non-printable delimiter with more human readable separator as
  sed can accept separators that can appear in the input data.
- Fix update-apparmor-samba-profile script, sed doesn't like
  multibyte separators; (bsc#1198309).
- Update to 4.16.0
  * New samba-dcerpcd binary to provide DCERPC in the member server
    setup
  * Certificate Auto Enrollment
  * Ability to add ports to dns forwarder addresses in internal DNS
    backend
  * No longer using Linux mandatory locks for sharemodes
  * SMB1 protocol has been deprecated, particularly older dialects
  * SMB1 protocol SMBCopy command removed
  * SMB1 server-side wildcard expansion removed
- Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101);
- Use systemd-sysusers to create system users; (bsc#1182847);</changelog>
  <changelog author="scabrero@suse.de" date="1671105600">- Update to 4.17.4
  * CVE-2022-44640 Upstream Heimdal free of user-controlled
    pointer in FAST; (bsc#14929);
  * CVE-2021-20251 Bad password count not incremented atomically;
    (bsc#14611);
  * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability;
    (bsc#15203);
  * CVE-2022-37966 rc4-hmac Kerberos session keys issued to
    modern servers; (bso#15237);
  * CVE-2022-37967 Kerberos constrained delegation ticket forgery
    possible against Samba AD DC; (bso#15231);
  * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak
    and should be avoided; (bso#15240);
  * pam_winbind uses time_t and pointers assuming they are of the
    same size; (bso#15224);
  * Heimdal session key selection in AS-REQ examines wrong entry;
    (bso#15219);
  * filter-subunit is inefficient with large numbers of
    knownfails; (bso#15258);
  * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories;
    (bso#15252);
  * The KDC logic arround msDs-supportedEncryptionTypes differs
    from Windows; (bso#13135);
  * libnet: change_password() doesn't work with
    dcerpc_samr_ChangePasswordUser4(); (bso#15206);
  * Heimdal session key selection in AS-REQ examines wrong entry;
    (bso#15219);
  * Memory leak in snprintf replacement functions; (bso#15230);
  * RODC doesn't reset badPwdCount reliable via an RWDC
    (CVE-2021-20251 regression); (bso#15253);
  * Prevent EBADF errors with vfs_glusterfs; (bso#15198);
  * %U for include directive doesn't work for share listing
    (netshareenum); (bso#15243);
  * Stack smashing in net offlinejoin requestodj; (bso#15257);
  * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue;
    (bso#15197);
  * Heimdal session key selection in AS-REQ examines wrong entry;
    (bso#15219);
- Remove deprecated if-{down,up} scripts; (bsc#1206444);
- Adjust the systemd drop-in file for named service; (bsc#1201689);
  * Paths are additive so do not repeat paths from named.service
  * Prefix the samba DLZ directory with "-" to ignore this path
    if it does not exists</changelog>
  <changelog author="nopower@suse.com" date="1671624000">- Change with_dc default to 0 (for non TW builds), ADDC feature is
  deprecated and will no longer be included in &gt;= SLE15-SP5;
  (jsc#PED-1122).</changelog>
  <changelog author="nopower@suse.com" date="1673524800">- Clean up logic for PAM migration settings in spec file.</changelog>
  <changelog author="nopower@suse.com" date="1674475200">- libdsdb-module-samba4 should be packaged as part of samba-libs and
  not samba-ad-dc-libs. Additionally no need for it to be
  removed conditionally.</changelog>
  <changelog author="nopower@suse.com" date="1674475201">- Remove non functioning ifup/ifdown samba-winbindd scripts;
  (bsc#1207414).</changelog>
  <changelog author="nopower@suse.com" date="1678363200">- Make samba-libs conflict with old samba-ad-dc-libs package
  to satisfy installcheck.</changelog>
  <changelog author="nopower@suse.com" date="1679745600">- Make (32bit) samba-libs conflict with old samba-ad-dc-libs
  package to satisfy installcheck.</changelog>
  <changelog author="nopower@suse.com" date="1681300800">- Update to 4.17.7
  * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords
    in cleartext; (bso#15315); (bsc#1209481).
  * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be
    deleted by unprivileged authenticated users; (bso#15276);
    (bsc#1209483).
  * CVE-2023-0614: samba: Access controlled AD LDAP attributes can
    be discovered; (bso#15270); (bsc#1209485).
  * large_ldap test is inefficient; (bso#15332).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
- Update to 4.17.6
  * streams_xattr is creating unexpected locks on folders;
    (bso#15314).
  * Use of the Azure AD Connect cloud sync tool is now supported
    for password hash synchronisation, allowing Samba AD Domains
    to synchronise passwords with this popular cloud environment;
    (bso#10635).
  * Spotlight doesn't work with latest macOS Ventura;
    (bso#15299).
  * New samba-dcerpc architecture does not scale gracefully;
    (bso#15310).
  * vfs_ceph incorrectly uses fsp_get_io_fd() instead of
    fsp_get_pathref_fd() in close and fstat; (bso#15307).
  * With clustering enabled samba-bgqd can core dump due to use
    after free; (bso#15293).
  * fd_load() function implicitly closes the fd where it should
    not; (bso#15311).
- Update to 4.17.5
  * smbc_getxattr() return value is incorrect; (bso#14808).
  * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not
    handled correctly; (bso#15172).
  * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210).
  * samba-tool gpo listall fails IPv6 only - finddcs() fails to
    find DC when there is only an AAAA record for the DC in DNS;
    (bso#15226).
  * smbd crashes if an FSCTL request is done on a stream handle;
    (bso#15236).
  * DFS links don't work anymore on Mac clients since 4.17;
    (bso#15277).
  * vfs_virusfilter segfault on access, directory edgecase
    (accessing NULL value); (bso#15283).
  * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5)
    based SChannel on NETLOGON (additional changes); (bso#15240).
  * %U for include directive doesn't work for share listing
    (netshareenum); (bso#15243).
  * Shares missing from netshareenum response in samba 4.17.4;
    (bso#15266).
  * ctdb: use-after-free in run_proc; (bso#15269).
  * irpc_destructor may crash during shutdown; (bso#15280).
  * auth3_generate_session_info_pac leaks wbcAuthUserInfo;
    (bso#15286).
  * smbclient segfaults with use after free on an optimized
    build; (bso#15268).
  * smbstatus leaking files in msg.sock and msg.lock;
    (bso#15282).
  * Leak in wbcCtxPingDc2; (bso#15164).
  * Access based share enum does not work in Samba 4.16+;
    (bso#15265).
  * Crash during share enumeration; (bso#15267).
  * rep_listxattr on FreeBSD does not properly check for reads
    off end of returned buffer; (bso#15271).
  * Avoid relying on C89 features in a few places; (bso#15281).</changelog>
  <changelog author="nopower@suse.com" date="1686830400">- Update to 4.17.8
  * log flood: smbd_calculate_access_mask_fsp: Access denied:
    message level should be lower; (bso#15302).
  * Floating point exception (FPE) via cli_pull_send at
    source3/libsmb/clireadwrite.c; (bso#15306).
  * test_tstream_more_tcp_user_timeout_spin fails intermittently
    on Rackspace GitLab runners; (bso#15328).
  * Reduce flapping of ridalloc test; (bso#15329).
  * large_ldap test is unreliable; (bso#15351).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * mdssvc may crash when initializing; (bso#15354).
  * Large directory optimization broken for non-lcomp path
    elements; (bso#15313).
  * streams_depot fails to create streams; (bso#15357).
  * shadow_copy2 and streams_depot don't play well together;
    (bso#15358).
  * wbinfo -u fails on ad dc with &gt;1000 users; (bso#15366).
  * winbindd idmap child contacts the domain controller without a
    need; (bso#15317).
  * idmap_autorid may fail to map sids of trusted domains for the
    first time; (bso#15318).
  * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings;
    (bso#15319).
  * net ads search -P doesn't work against servers in other
    domains; (bso#15323).
  * DS ACEs might be inherited to unrelated object classes;
    (bso#15338).
  * Temporary smbXsrv_tcon_global.tdb can't be parsed;
    (bso#15353).
  * Setting veto files = /.*/ break listing directories;
    (bso#15360); (bsc#1212375).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
  * dsgetdcname: assumes local system uses IPv4; (bso#15325).</changelog>
  <changelog author="nopower@suse.com" date="1688644800">- Update to 4.17.9
  * Backport --pidl-developer fixes; (bso#15404).
  * smbd_scavenger crashes when service smbd is stopped;
    (bso#15275).
  * vfs_fruit might cause a failing open for delete; (bso#15378).
  * named crashes on DLZ zone update; (bso#14030).
  * winbind recurses into itself via rpcd_lsad; (bso#15361).
  * cli_list loops 100% CPU against pre-lanman2 servers;
    (bso#15382).
  * smbclient leaks fds with showacls; (bso#15391).
  * aes256 smb3 encryption algorithms are not allowed in
    smb3_sid_parse(); (bso#15374).
  * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR;
    (bso#15413).
  * smbget memory leak if failed to download files recursively;
    (bso#15403).</changelog>
  <changelog author="nopower@suse.com" date="1689249600">- CVE-2022-2127: lm_resp_len not checked properly in
  winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
- CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
  Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
- CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
  Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
- CVE-2023-34968: Spotlight server-side Share Path Disclosure;
  (bso#15388); (bsc#1213171).
- CVE-2023-3347: Samba doesn't require SMB2+ signing if
  `server signing = mandatory` is set; (bso#15397); (bsc#1213170).</changelog>
  <changelog author="nopower@suse.com" date="1689595200">- secure channel faulty since Windows 10/11 update 07/2023;
  (bso#15418); (bsc#1213384).</changelog>
  <changelog author="scabrero@suse.de" date="1690891200">- net ads lookup with unspecified realm fails; (bso#15384);
  (bsc#1213826);</changelog>
  <changelog author="scabrero@suse.de" date="1691496000">- Move libcluster-samba4.so from samba-libs to samba-client-libs;
  (bsc#1213940);</changelog>
  <changelog author="scabrero@suse.de" date="1692014400">- Fix DFS not working with widelinks enabled; (bsc#1213607);
  (bso#15435);</changelog>
  <changelog author="nopower@suse.com" date="1696420800">- CVE-2023-4091: samba: Client can truncate file with read-only
  permissions; (bsc#1215904); (bso#15439).
- CVE-2023-42669: samba: rpcecho, enabled and running in AD DC,
  allows blocking sleep on request; (bso#1215905); (bso#15474).
- CVE-2023-42670: samba:  The procedure number is out of range
  when starting Active Directory Users and Computers;
  (bsc#1215906); (bso#15473).
- CVE-2023-3961: samba: Unsanitized client pipe name passed to
  local_np_connect(); (bsc#1215907); (bso#15422).
- CVE-2023-4154: samba: dirsync allows SYSTEM access with only
  "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES;
  (bsc#1215908); (bso#15424).</changelog>
</package>
<package pkgid="48a8a77c1454ed3a4ffa2f7b62208fb0ed8b923a28125741067cdc9bae470bc0" name="samba-client-libs" arch="aarch64">
  <version epoch="0" ver="4.17.9+git.421.abde31ca5c2" rel="150500.3.11.1"/>
  <changelog author="nopower@suse.com" date="1664452800">- Update to 4.15.10
  * Possible use after free of connection_struct when iterating
    smbd_server_connection-&gt;connections; (bso#15128);
    (bsc#1200102).
  * smbXsrv_connection_shutdown_send result leaked; (bso#15174).
  * Spotlight RPC service returns wrong response when Spotlight
    is disabled on a share; (bso#15086).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1;
    (bso#15153).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * Missing READ_LEASE break could cause data corruption;
    (bso#15148).
  * rpcclient can crash using setuserinfo(2); (bso#15124).
  * Samba fails to build with glibc 2.36 caused by including
    &lt;sys/mount.h&gt; in libreplace; (bso#15132).
  * SMB1 negotiation can fail to handle connection errors;
    (bso#15152).
  * samba-tool domain join segfault when joining a samba ad
    domain; (bso#15078).
- Update to 4.15.9
  * CVE-2022-32742:SMB1 code does not correct verify SMB1write,
    SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
    (bsc#1201496).
  * CVE-2022-32746: samba: Use-after-free occurring in database
    audit logging; (bso#15009); (bso#15096); (bsc#1201490).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1668600000">- Update to 4.15.12
  * CVE-2022-42898: samba: heimdal: Samba buffer overflow
    vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126).
- Update to 4.15.11
  * Allow rebuild of Centos 8 images after move to vault for
    Samba 4.15; (bso#15193).
  * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3();
    (bso#15134); (bsc#1204254)</changelog>
  <changelog author="scabrero@suse.de" date="1669636800">- Install a systemd drop-in file for named service to allow
  read/write access to the DLZ directory; (bsc#1201689);</changelog>
  <changelog author="dmulder@suse.com" date="1669896000">- Introduce without-smb1-server spec flag; (bsc#1205104);
- Update to 4.17.3
  * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit
    systems; (bsc#1205126); (bso#15203);
- Replace obsolete python-gpgme with python-gpg
  * Upstream replaced it in v4.9.5 -- bso#13728
- Update to 4.17.2
  * CVE-2022-3592 [SECURITY] samba: Wide links protection broken;
    (bso#15207); (bsc#1204499).
  * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal
    unwrap_des3();(bso#15134); (bsc#1204254).
- Update to 4.17.1
  * CVE-2021-20251 [SECURITY] Bad password count not incremented
    atomically; (bso#14611).
  * smbXsrv_connection_shutdown_send result leaked; (bso#15174).
  * Flush on a named stream never completes; (bso#15182).
  * Permission denied calling SMBC_getatr when file not exists;
    (bso#15195).
  * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later
    over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC;
    (bso#15189).
  * pytest: add file removal helpers for TestCaseInTempDir;
    (bso#15191).
  * CVE-2021-20251 [SECURITY] Bad password count not incremented
    atomically; (bso#14611).
  * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later
    over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC;
    (bso#15189).
  * Flush on a named stream never completes; (bso#15182).
  * vfs_gpfs silently garbles timestamps &gt; year 2106;
    (bso#15151).
  * CVE-2021-20251 [SECURITY] Bad password count not incremented
    atomically; (bso#14611).
  * multi-channel socket passing may hit a race if one of the
    involved processes already existed; (bso#15200).
  * memory leak on temporary of struct imessaging_post_state and
    struct tevent_immediate on struct imessaging_context (in
    rpcd_spoolss and maybe others); (bso#15201).
  * Since popt1.19 various use after free errors using result of
    poptGetArg are now exposed; (bso#15205); (boo#1204279).
  * Remove special case for O_CREAT in SMB_VFS_OPENAT from
    vfs_glusterfs; (bso#15192).
  * GETPWSID in memory cache grows indefinetly with each NTLM
    auth; (bso#15169).
  * CVE-2021-20251 [SECURITY] Bad password count not incremented
    atomically; (bso#14611).
- Install a systemd drop-in file for named service to allow
  read/write access to the DLZ directory; (bsc#1201689);
- Fix use after free errors resulting from using return of
  poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205).
- s3: smbd: Fix memory leak in
  smbd_server_connection_terminate_done(); (bso#15174).
- Disable SMB1 for tumbleweed builds.
- Update to 4.17.0
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1;
    (bso#15153).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * Cross-node multi-channel reconnects result in SMB2 Negotiate
    returning NT_STATUS_NOT_SUPPORTED; (bso#15159).
  * winbind at info level debug can coredump when processing
    wb_lookupusergroups; (bso#15160).
  * Make use of glfs_*at() API calls in vfs_glusterfs;
    (bso#15157).
  * Possible use after free of connection_struct when iterating
    smbd_server_connection-&gt;connections; (bso#15128).
  * `net usershare add` fails with flag works with --long but
    fails with -l; (bso#15145).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Performance regression on contended path based operations;
    (bso#15125).
  * Missing READ_LEASE break could cause data corruption;
    (bso#15148).
  * libsamba-errors uses a wrong version number; (bso#15141).
  * SMB1 negotiation can fail to handle connection errors;
    (bso#15152).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * 4.17.rc1 still uses symlink-race prone unix_convert();
    (bso#15144).
  * Backport fileserver related changed to 4.17.0rc2;
    (bso#15146).
  * Manpage for smbstatus json is missing; (bso#15147).
  * Backport fileserver related changed to 4.17.0rc2;
    (bso#15146).
  * Performance regression on contended path based operations;
    (bso#15125).
  * Backport fileserver related changed to 4.17.0rc2;
    (bso#15146).
  * Fix issues found by coverity in smbstatus json code;
    (bso#15140).
  * Backport fileserver related changed to 4.17.0rc2;
    (bso#15146).
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Update to 4.16.4
  * CVE-2022-2031: Samba AD users can bypass certain restrictions
    associated with changing passwords; (bsc#1201495); (bso#15047);
  * CVE-2022-32744: Samba AD users can forge password change
    requests for any user; (bsc#1201493); (bso#15074);
  * CVE-2022-32745: Samba AD users can crash the server process
    with an LDAP add or modify request; (bsc#1201492); (bso#15008);
  * CVE-2022-32746: Samba AD users can induce a use-after-free in
    the server process with an LDAP add or modify request;
    (bsc#1201490); (bso#15009);
  * CVE-2022-32742: Server memory information leak via SMB1;
    (bsc#1201496); (bso#15085);
- Update to 4.16.3
  * Using vfs_streams_xattr and deleting a file causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work;
    (bso#15076);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in
    developer mode; (bso#15095);
  * Crash in streams_xattr because fsp-&gt;base_fsp-&gt;fsp_name is
    NULL; (bso#15105);
  * Crash in rpcd_classic - NULL pointer deference in
    mangle_is_mangled(); (bso#15118);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * Fix check for chown when processing NFSv4 ACL; (bso#15120);
  * The pcap background queue process should not be stopped;
    (bso#15082);
  * testparm: Fix typo in idmap rangesize check; (bso#15097);
  * net ads info returns LDAP server and LDAP server name as
    null; (bso#15106);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * CTDB child process logging does not work as expected;
    (bso#15090);
- Update spec file to fix the optional Heimdal DC build
- Fix external trusts with MIT Kerberos 1.20
- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Add sysuser-shadow requirement for packages using
  systemd-sysusers
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Update to 4.16.2
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * Reintroduce netgroups support; (bso#15087);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Update from 4.15  to 4.16 breaks discovery of [homes] on
    standalone server from Win and IOS; (bso#15062);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient -E doesn't work as advertised; (bso#15075);
  * The samba background daemon doesn't refresh the printcap cache
    on startup; (bso#15081);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Fix samba4.blackbox.net_ads_dns_async test with bind9 &gt;= 9.17.7
- Support building with MIT Kerberos 1.20
- Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC;
  (CVE-2020-17049);
- Resource Based Constrained Delegation (RBCD) for Samba AD DC
- Support building with gcc 12.1
- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);
- Update to 4.16.1
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written to;
    (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * Need to describe --builtin-libraries= better (compare with
  - -bundled-libraries); (bso#8731);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * Username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * KVNO off by 100000; (bso#14951);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
- Update update-apparmor-samba-profile script, replace
  non-printable delimiter with more human readable separator as
  sed can accept separators that can appear in the input data.
- Fix update-apparmor-samba-profile script, sed doesn't like
  multibyte separators; (bsc#1198309).
- Update to 4.16.0
  * New samba-dcerpcd binary to provide DCERPC in the member server
    setup
  * Certificate Auto Enrollment
  * Ability to add ports to dns forwarder addresses in internal DNS
    backend
  * No longer using Linux mandatory locks for sharemodes
  * SMB1 protocol has been deprecated, particularly older dialects
  * SMB1 protocol SMBCopy command removed
  * SMB1 server-side wildcard expansion removed
- Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101);
- Use systemd-sysusers to create system users; (bsc#1182847);</changelog>
  <changelog author="scabrero@suse.de" date="1671105600">- Update to 4.17.4
  * CVE-2022-44640 Upstream Heimdal free of user-controlled
    pointer in FAST; (bsc#14929);
  * CVE-2021-20251 Bad password count not incremented atomically;
    (bsc#14611);
  * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability;
    (bsc#15203);
  * CVE-2022-37966 rc4-hmac Kerberos session keys issued to
    modern servers; (bso#15237);
  * CVE-2022-37967 Kerberos constrained delegation ticket forgery
    possible against Samba AD DC; (bso#15231);
  * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak
    and should be avoided; (bso#15240);
  * pam_winbind uses time_t and pointers assuming they are of the
    same size; (bso#15224);
  * Heimdal session key selection in AS-REQ examines wrong entry;
    (bso#15219);
  * filter-subunit is inefficient with large numbers of
    knownfails; (bso#15258);
  * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories;
    (bso#15252);
  * The KDC logic arround msDs-supportedEncryptionTypes differs
    from Windows; (bso#13135);
  * libnet: change_password() doesn't work with
    dcerpc_samr_ChangePasswordUser4(); (bso#15206);
  * Heimdal session key selection in AS-REQ examines wrong entry;
    (bso#15219);
  * Memory leak in snprintf replacement functions; (bso#15230);
  * RODC doesn't reset badPwdCount reliable via an RWDC
    (CVE-2021-20251 regression); (bso#15253);
  * Prevent EBADF errors with vfs_glusterfs; (bso#15198);
  * %U for include directive doesn't work for share listing
    (netshareenum); (bso#15243);
  * Stack smashing in net offlinejoin requestodj; (bso#15257);
  * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue;
    (bso#15197);
  * Heimdal session key selection in AS-REQ examines wrong entry;
    (bso#15219);
- Remove deprecated if-{down,up} scripts; (bsc#1206444);
- Adjust the systemd drop-in file for named service; (bsc#1201689);
  * Paths are additive so do not repeat paths from named.service
  * Prefix the samba DLZ directory with "-" to ignore this path
    if it does not exists</changelog>
  <changelog author="nopower@suse.com" date="1671624000">- Change with_dc default to 0 (for non TW builds), ADDC feature is
  deprecated and will no longer be included in &gt;= SLE15-SP5;
  (jsc#PED-1122).</changelog>
  <changelog author="nopower@suse.com" date="1673524800">- Clean up logic for PAM migration settings in spec file.</changelog>
  <changelog author="nopower@suse.com" date="1674475200">- libdsdb-module-samba4 should be packaged as part of samba-libs and
  not samba-ad-dc-libs. Additionally no need for it to be
  removed conditionally.</changelog>
  <changelog author="nopower@suse.com" date="1674475201">- Remove non functioning ifup/ifdown samba-winbindd scripts;
  (bsc#1207414).</changelog>
  <changelog author="nopower@suse.com" date="1678363200">- Make samba-libs conflict with old samba-ad-dc-libs package
  to satisfy installcheck.</changelog>
  <changelog author="nopower@suse.com" date="1679745600">- Make (32bit) samba-libs conflict with old samba-ad-dc-libs
  package to satisfy installcheck.</changelog>
  <changelog author="nopower@suse.com" date="1681300800">- Update to 4.17.7
  * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords
    in cleartext; (bso#15315); (bsc#1209481).
  * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be
    deleted by unprivileged authenticated users; (bso#15276);
    (bsc#1209483).
  * CVE-2023-0614: samba: Access controlled AD LDAP attributes can
    be discovered; (bso#15270); (bsc#1209485).
  * large_ldap test is inefficient; (bso#15332).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
- Update to 4.17.6
  * streams_xattr is creating unexpected locks on folders;
    (bso#15314).
  * Use of the Azure AD Connect cloud sync tool is now supported
    for password hash synchronisation, allowing Samba AD Domains
    to synchronise passwords with this popular cloud environment;
    (bso#10635).
  * Spotlight doesn't work with latest macOS Ventura;
    (bso#15299).
  * New samba-dcerpc architecture does not scale gracefully;
    (bso#15310).
  * vfs_ceph incorrectly uses fsp_get_io_fd() instead of
    fsp_get_pathref_fd() in close and fstat; (bso#15307).
  * With clustering enabled samba-bgqd can core dump due to use
    after free; (bso#15293).
  * fd_load() function implicitly closes the fd where it should
    not; (bso#15311).
- Update to 4.17.5
  * smbc_getxattr() return value is incorrect; (bso#14808).
  * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not
    handled correctly; (bso#15172).
  * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210).
  * samba-tool gpo listall fails IPv6 only - finddcs() fails to
    find DC when there is only an AAAA record for the DC in DNS;
    (bso#15226).
  * smbd crashes if an FSCTL request is done on a stream handle;
    (bso#15236).
  * DFS links don't work anymore on Mac clients since 4.17;
    (bso#15277).
  * vfs_virusfilter segfault on access, directory edgecase
    (accessing NULL value); (bso#15283).
  * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5)
    based SChannel on NETLOGON (additional changes); (bso#15240).
  * %U for include directive doesn't work for share listing
    (netshareenum); (bso#15243).
  * Shares missing from netshareenum response in samba 4.17.4;
    (bso#15266).
  * ctdb: use-after-free in run_proc; (bso#15269).
  * irpc_destructor may crash during shutdown; (bso#15280).
  * auth3_generate_session_info_pac leaks wbcAuthUserInfo;
    (bso#15286).
  * smbclient segfaults with use after free on an optimized
    build; (bso#15268).
  * smbstatus leaking files in msg.sock and msg.lock;
    (bso#15282).
  * Leak in wbcCtxPingDc2; (bso#15164).
  * Access based share enum does not work in Samba 4.16+;
    (bso#15265).
  * Crash during share enumeration; (bso#15267).
  * rep_listxattr on FreeBSD does not properly check for reads
    off end of returned buffer; (bso#15271).
  * Avoid relying on C89 features in a few places; (bso#15281).</changelog>
  <changelog author="nopower@suse.com" date="1686830400">- Update to 4.17.8
  * log flood: smbd_calculate_access_mask_fsp: Access denied:
    message level should be lower; (bso#15302).
  * Floating point exception (FPE) via cli_pull_send at
    source3/libsmb/clireadwrite.c; (bso#15306).
  * test_tstream_more_tcp_user_timeout_spin fails intermittently
    on Rackspace GitLab runners; (bso#15328).
  * Reduce flapping of ridalloc test; (bso#15329).
  * large_ldap test is unreliable; (bso#15351).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * mdssvc may crash when initializing; (bso#15354).
  * Large directory optimization broken for non-lcomp path
    elements; (bso#15313).
  * streams_depot fails to create streams; (bso#15357).
  * shadow_copy2 and streams_depot don't play well together;
    (bso#15358).
  * wbinfo -u fails on ad dc with &gt;1000 users; (bso#15366).
  * winbindd idmap child contacts the domain controller without a
    need; (bso#15317).
  * idmap_autorid may fail to map sids of trusted domains for the
    first time; (bso#15318).
  * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings;
    (bso#15319).
  * net ads search -P doesn't work against servers in other
    domains; (bso#15323).
  * DS ACEs might be inherited to unrelated object classes;
    (bso#15338).
  * Temporary smbXsrv_tcon_global.tdb can't be parsed;
    (bso#15353).
  * Setting veto files = /.*/ break listing directories;
    (bso#15360); (bsc#1212375).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
  * dsgetdcname: assumes local system uses IPv4; (bso#15325).</changelog>
  <changelog author="nopower@suse.com" date="1688644800">- Update to 4.17.9
  * Backport --pidl-developer fixes; (bso#15404).
  * smbd_scavenger crashes when service smbd is stopped;
    (bso#15275).
  * vfs_fruit might cause a failing open for delete; (bso#15378).
  * named crashes on DLZ zone update; (bso#14030).
  * winbind recurses into itself via rpcd_lsad; (bso#15361).
  * cli_list loops 100% CPU against pre-lanman2 servers;
    (bso#15382).
  * smbclient leaks fds with showacls; (bso#15391).
  * aes256 smb3 encryption algorithms are not allowed in
    smb3_sid_parse(); (bso#15374).
  * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR;
    (bso#15413).
  * smbget memory leak if failed to download files recursively;
    (bso#15403).</changelog>
  <changelog author="nopower@suse.com" date="1689249600">- CVE-2022-2127: lm_resp_len not checked properly in
  winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
- CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
  Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
- CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
  Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
- CVE-2023-34968: Spotlight server-side Share Path Disclosure;
  (bso#15388); (bsc#1213171).
- CVE-2023-3347: Samba doesn't require SMB2+ signing if
  `server signing = mandatory` is set; (bso#15397); (bsc#1213170).</changelog>
  <changelog author="nopower@suse.com" date="1689595200">- secure channel faulty since Windows 10/11 update 07/2023;
  (bso#15418); (bsc#1213384).</changelog>
  <changelog author="scabrero@suse.de" date="1690891200">- net ads lookup with unspecified realm fails; (bso#15384);
  (bsc#1213826);</changelog>
  <changelog author="scabrero@suse.de" date="1691496000">- Move libcluster-samba4.so from samba-libs to samba-client-libs;
  (bsc#1213940);</changelog>
  <changelog author="scabrero@suse.de" date="1692014400">- Fix DFS not working with widelinks enabled; (bsc#1213607);
  (bso#15435);</changelog>
  <changelog author="nopower@suse.com" date="1696420800">- CVE-2023-4091: samba: Client can truncate file with read-only
  permissions; (bsc#1215904); (bso#15439).
- CVE-2023-42669: samba: rpcecho, enabled and running in AD DC,
  allows blocking sleep on request; (bso#1215905); (bso#15474).
- CVE-2023-42670: samba:  The procedure number is out of range
  when starting Active Directory Users and Computers;
  (bsc#1215906); (bso#15473).
- CVE-2023-3961: samba: Unsanitized client pipe name passed to
  local_np_connect(); (bsc#1215907); (bso#15422).
- CVE-2023-4154: samba: dirsync allows SYSTEM access with only
  "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES;
  (bsc#1215908); (bso#15424).</changelog>
</package>
<package pkgid="10ee51d1c82b4b1d5182b09fde679d71d3878b979ab3aa779a1fd84262deefbe" name="samba-client-libs" arch="s390x">
  <version epoch="0" ver="4.17.9+git.421.abde31ca5c2" rel="150500.3.11.1"/>
  <changelog author="nopower@suse.com" date="1664452800">- Update to 4.15.10
  * Possible use after free of connection_struct when iterating
    smbd_server_connection-&gt;connections; (bso#15128);
    (bsc#1200102).
  * smbXsrv_connection_shutdown_send result leaked; (bso#15174).
  * Spotlight RPC service returns wrong response when Spotlight
    is disabled on a share; (bso#15086).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1;
    (bso#15153).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * Missing READ_LEASE break could cause data corruption;
    (bso#15148).
  * rpcclient can crash using setuserinfo(2); (bso#15124).
  * Samba fails to build with glibc 2.36 caused by including
    &lt;sys/mount.h&gt; in libreplace; (bso#15132).
  * SMB1 negotiation can fail to handle connection errors;
    (bso#15152).
  * samba-tool domain join segfault when joining a samba ad
    domain; (bso#15078).
- Update to 4.15.9
  * CVE-2022-32742:SMB1 code does not correct verify SMB1write,
    SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
    (bsc#1201496).
  * CVE-2022-32746: samba: Use-after-free occurring in database
    audit logging; (bso#15009); (bso#15096); (bsc#1201490).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1668600000">- Update to 4.15.12
  * CVE-2022-42898: samba: heimdal: Samba buffer overflow
    vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126).
- Update to 4.15.11
  * Allow rebuild of Centos 8 images after move to vault for
    Samba 4.15; (bso#15193).
  * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3();
    (bso#15134); (bsc#1204254)</changelog>
  <changelog author="scabrero@suse.de" date="1669636800">- Install a systemd drop-in file for named service to allow
  read/write access to the DLZ directory; (bsc#1201689);</changelog>
  <changelog author="dmulder@suse.com" date="1669896000">- Introduce without-smb1-server spec flag; (bsc#1205104);
- Update to 4.17.3
  * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit
    systems; (bsc#1205126); (bso#15203);
- Replace obsolete python-gpgme with python-gpg
  * Upstream replaced it in v4.9.5 -- bso#13728
- Update to 4.17.2
  * CVE-2022-3592 [SECURITY] samba: Wide links protection broken;
    (bso#15207); (bsc#1204499).
  * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal
    unwrap_des3();(bso#15134); (bsc#1204254).
- Update to 4.17.1
  * CVE-2021-20251 [SECURITY] Bad password count not incremented
    atomically; (bso#14611).
  * smbXsrv_connection_shutdown_send result leaked; (bso#15174).
  * Flush on a named stream never completes; (bso#15182).
  * Permission denied calling SMBC_getatr when file not exists;
    (bso#15195).
  * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later
    over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC;
    (bso#15189).
  * pytest: add file removal helpers for TestCaseInTempDir;
    (bso#15191).
  * CVE-2021-20251 [SECURITY] Bad password count not incremented
    atomically; (bso#14611).
  * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later
    over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC;
    (bso#15189).
  * Flush on a named stream never completes; (bso#15182).
  * vfs_gpfs silently garbles timestamps &gt; year 2106;
    (bso#15151).
  * CVE-2021-20251 [SECURITY] Bad password count not incremented
    atomically; (bso#14611).
  * multi-channel socket passing may hit a race if one of the
    involved processes already existed; (bso#15200).
  * memory leak on temporary of struct imessaging_post_state and
    struct tevent_immediate on struct imessaging_context (in
    rpcd_spoolss and maybe others); (bso#15201).
  * Since popt1.19 various use after free errors using result of
    poptGetArg are now exposed; (bso#15205); (boo#1204279).
  * Remove special case for O_CREAT in SMB_VFS_OPENAT from
    vfs_glusterfs; (bso#15192).
  * GETPWSID in memory cache grows indefinetly with each NTLM
    auth; (bso#15169).
  * CVE-2021-20251 [SECURITY] Bad password count not incremented
    atomically; (bso#14611).
- Install a systemd drop-in file for named service to allow
  read/write access to the DLZ directory; (bsc#1201689);
- Fix use after free errors resulting from using return of
  poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205).
- s3: smbd: Fix memory leak in
  smbd_server_connection_terminate_done(); (bso#15174).
- Disable SMB1 for tumbleweed builds.
- Update to 4.17.0
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1;
    (bso#15153).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * Cross-node multi-channel reconnects result in SMB2 Negotiate
    returning NT_STATUS_NOT_SUPPORTED; (bso#15159).
  * winbind at info level debug can coredump when processing
    wb_lookupusergroups; (bso#15160).
  * Make use of glfs_*at() API calls in vfs_glusterfs;
    (bso#15157).
  * Possible use after free of connection_struct when iterating
    smbd_server_connection-&gt;connections; (bso#15128).
  * `net usershare add` fails with flag works with --long but
    fails with -l; (bso#15145).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Performance regression on contended path based operations;
    (bso#15125).
  * Missing READ_LEASE break could cause data corruption;
    (bso#15148).
  * libsamba-errors uses a wrong version number; (bso#15141).
  * SMB1 negotiation can fail to handle connection errors;
    (bso#15152).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * 4.17.rc1 still uses symlink-race prone unix_convert();
    (bso#15144).
  * Backport fileserver related changed to 4.17.0rc2;
    (bso#15146).
  * Manpage for smbstatus json is missing; (bso#15147).
  * Backport fileserver related changed to 4.17.0rc2;
    (bso#15146).
  * Performance regression on contended path based operations;
    (bso#15125).
  * Backport fileserver related changed to 4.17.0rc2;
    (bso#15146).
  * Fix issues found by coverity in smbstatus json code;
    (bso#15140).
  * Backport fileserver related changed to 4.17.0rc2;
    (bso#15146).
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Update to 4.16.4
  * CVE-2022-2031: Samba AD users can bypass certain restrictions
    associated with changing passwords; (bsc#1201495); (bso#15047);
  * CVE-2022-32744: Samba AD users can forge password change
    requests for any user; (bsc#1201493); (bso#15074);
  * CVE-2022-32745: Samba AD users can crash the server process
    with an LDAP add or modify request; (bsc#1201492); (bso#15008);
  * CVE-2022-32746: Samba AD users can induce a use-after-free in
    the server process with an LDAP add or modify request;
    (bsc#1201490); (bso#15009);
  * CVE-2022-32742: Server memory information leak via SMB1;
    (bsc#1201496); (bso#15085);
- Update to 4.16.3
  * Using vfs_streams_xattr and deleting a file causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work;
    (bso#15076);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in
    developer mode; (bso#15095);
  * Crash in streams_xattr because fsp-&gt;base_fsp-&gt;fsp_name is
    NULL; (bso#15105);
  * Crash in rpcd_classic - NULL pointer deference in
    mangle_is_mangled(); (bso#15118);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * Fix check for chown when processing NFSv4 ACL; (bso#15120);
  * The pcap background queue process should not be stopped;
    (bso#15082);
  * testparm: Fix typo in idmap rangesize check; (bso#15097);
  * net ads info returns LDAP server and LDAP server name as
    null; (bso#15106);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * CTDB child process logging does not work as expected;
    (bso#15090);
- Update spec file to fix the optional Heimdal DC build
- Fix external trusts with MIT Kerberos 1.20
- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Add sysuser-shadow requirement for packages using
  systemd-sysusers
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Update to 4.16.2
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * Reintroduce netgroups support; (bso#15087);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Update from 4.15  to 4.16 breaks discovery of [homes] on
    standalone server from Win and IOS; (bso#15062);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient -E doesn't work as advertised; (bso#15075);
  * The samba background daemon doesn't refresh the printcap cache
    on startup; (bso#15081);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Fix samba4.blackbox.net_ads_dns_async test with bind9 &gt;= 9.17.7
- Support building with MIT Kerberos 1.20
- Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC;
  (CVE-2020-17049);
- Resource Based Constrained Delegation (RBCD) for Samba AD DC
- Support building with gcc 12.1
- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);
- Update to 4.16.1
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written to;
    (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * Need to describe --builtin-libraries= better (compare with
  - -bundled-libraries); (bso#8731);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * Username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * KVNO off by 100000; (bso#14951);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
- Update update-apparmor-samba-profile script, replace
  non-printable delimiter with more human readable separator as
  sed can accept separators that can appear in the input data.
- Fix update-apparmor-samba-profile script, sed doesn't like
  multibyte separators; (bsc#1198309).
- Update to 4.16.0
  * New samba-dcerpcd binary to provide DCERPC in the member server
    setup
  * Certificate Auto Enrollment
  * Ability to add ports to dns forwarder addresses in internal DNS
    backend
  * No longer using Linux mandatory locks for sharemodes
  * SMB1 protocol has been deprecated, particularly older dialects
  * SMB1 protocol SMBCopy command removed
  * SMB1 server-side wildcard expansion removed
- Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101);
- Use systemd-sysusers to create system users; (bsc#1182847);</changelog>
  <changelog author="scabrero@suse.de" date="1671105600">- Update to 4.17.4
  * CVE-2022-44640 Upstream Heimdal free of user-controlled
    pointer in FAST; (bsc#14929);
  * CVE-2021-20251 Bad password count not incremented atomically;
    (bsc#14611);
  * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability;
    (bsc#15203);
  * CVE-2022-37966 rc4-hmac Kerberos session keys issued to
    modern servers; (bso#15237);
  * CVE-2022-37967 Kerberos constrained delegation ticket forgery
    possible against Samba AD DC; (bso#15231);
  * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak
    and should be avoided; (bso#15240);
  * pam_winbind uses time_t and pointers assuming they are of the
    same size; (bso#15224);
  * Heimdal session key selection in AS-REQ examines wrong entry;
    (bso#15219);
  * filter-subunit is inefficient with large numbers of
    knownfails; (bso#15258);
  * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories;
    (bso#15252);
  * The KDC logic arround msDs-supportedEncryptionTypes differs
    from Windows; (bso#13135);
  * libnet: change_password() doesn't work with
    dcerpc_samr_ChangePasswordUser4(); (bso#15206);
  * Heimdal session key selection in AS-REQ examines wrong entry;
    (bso#15219);
  * Memory leak in snprintf replacement functions; (bso#15230);
  * RODC doesn't reset badPwdCount reliable via an RWDC
    (CVE-2021-20251 regression); (bso#15253);
  * Prevent EBADF errors with vfs_glusterfs; (bso#15198);
  * %U for include directive doesn't work for share listing
    (netshareenum); (bso#15243);
  * Stack smashing in net offlinejoin requestodj; (bso#15257);
  * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue;
    (bso#15197);
  * Heimdal session key selection in AS-REQ examines wrong entry;
    (bso#15219);
- Remove deprecated if-{down,up} scripts; (bsc#1206444);
- Adjust the systemd drop-in file for named service; (bsc#1201689);
  * Paths are additive so do not repeat paths from named.service
  * Prefix the samba DLZ directory with "-" to ignore this path
    if it does not exists</changelog>
  <changelog author="nopower@suse.com" date="1671624000">- Change with_dc default to 0 (for non TW builds), ADDC feature is
  deprecated and will no longer be included in &gt;= SLE15-SP5;
  (jsc#PED-1122).</changelog>
  <changelog author="nopower@suse.com" date="1673524800">- Clean up logic for PAM migration settings in spec file.</changelog>
  <changelog author="nopower@suse.com" date="1674475200">- libdsdb-module-samba4 should be packaged as part of samba-libs and
  not samba-ad-dc-libs. Additionally no need for it to be
  removed conditionally.</changelog>
  <changelog author="nopower@suse.com" date="1674475201">- Remove non functioning ifup/ifdown samba-winbindd scripts;
  (bsc#1207414).</changelog>
  <changelog author="nopower@suse.com" date="1678363200">- Make samba-libs conflict with old samba-ad-dc-libs package
  to satisfy installcheck.</changelog>
  <changelog author="nopower@suse.com" date="1679745600">- Make (32bit) samba-libs conflict with old samba-ad-dc-libs
  package to satisfy installcheck.</changelog>
  <changelog author="nopower@suse.com" date="1681300800">- Update to 4.17.7
  * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords
    in cleartext; (bso#15315); (bsc#1209481).
  * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be
    deleted by unprivileged authenticated users; (bso#15276);
    (bsc#1209483).
  * CVE-2023-0614: samba: Access controlled AD LDAP attributes can
    be discovered; (bso#15270); (bsc#1209485).
  * large_ldap test is inefficient; (bso#15332).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
- Update to 4.17.6
  * streams_xattr is creating unexpected locks on folders;
    (bso#15314).
  * Use of the Azure AD Connect cloud sync tool is now supported
    for password hash synchronisation, allowing Samba AD Domains
    to synchronise passwords with this popular cloud environment;
    (bso#10635).
  * Spotlight doesn't work with latest macOS Ventura;
    (bso#15299).
  * New samba-dcerpc architecture does not scale gracefully;
    (bso#15310).
  * vfs_ceph incorrectly uses fsp_get_io_fd() instead of
    fsp_get_pathref_fd() in close and fstat; (bso#15307).
  * With clustering enabled samba-bgqd can core dump due to use
    after free; (bso#15293).
  * fd_load() function implicitly closes the fd where it should
    not; (bso#15311).
- Update to 4.17.5
  * smbc_getxattr() return value is incorrect; (bso#14808).
  * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not
    handled correctly; (bso#15172).
  * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210).
  * samba-tool gpo listall fails IPv6 only - finddcs() fails to
    find DC when there is only an AAAA record for the DC in DNS;
    (bso#15226).
  * smbd crashes if an FSCTL request is done on a stream handle;
    (bso#15236).
  * DFS links don't work anymore on Mac clients since 4.17;
    (bso#15277).
  * vfs_virusfilter segfault on access, directory edgecase
    (accessing NULL value); (bso#15283).
  * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5)
    based SChannel on NETLOGON (additional changes); (bso#15240).
  * %U for include directive doesn't work for share listing
    (netshareenum); (bso#15243).
  * Shares missing from netshareenum response in samba 4.17.4;
    (bso#15266).
  * ctdb: use-after-free in run_proc; (bso#15269).
  * irpc_destructor may crash during shutdown; (bso#15280).
  * auth3_generate_session_info_pac leaks wbcAuthUserInfo;
    (bso#15286).
  * smbclient segfaults with use after free on an optimized
    build; (bso#15268).
  * smbstatus leaking files in msg.sock and msg.lock;
    (bso#15282).
  * Leak in wbcCtxPingDc2; (bso#15164).
  * Access based share enum does not work in Samba 4.16+;
    (bso#15265).
  * Crash during share enumeration; (bso#15267).
  * rep_listxattr on FreeBSD does not properly check for reads
    off end of returned buffer; (bso#15271).
  * Avoid relying on C89 features in a few places; (bso#15281).</changelog>
  <changelog author="nopower@suse.com" date="1686830400">- Update to 4.17.8
  * log flood: smbd_calculate_access_mask_fsp: Access denied:
    message level should be lower; (bso#15302).
  * Floating point exception (FPE) via cli_pull_send at
    source3/libsmb/clireadwrite.c; (bso#15306).
  * test_tstream_more_tcp_user_timeout_spin fails intermittently
    on Rackspace GitLab runners; (bso#15328).
  * Reduce flapping of ridalloc test; (bso#15329).
  * large_ldap test is unreliable; (bso#15351).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * mdssvc may crash when initializing; (bso#15354).
  * Large directory optimization broken for non-lcomp path
    elements; (bso#15313).
  * streams_depot fails to create streams; (bso#15357).
  * shadow_copy2 and streams_depot don't play well together;
    (bso#15358).
  * wbinfo -u fails on ad dc with &gt;1000 users; (bso#15366).
  * winbindd idmap child contacts the domain controller without a
    need; (bso#15317).
  * idmap_autorid may fail to map sids of trusted domains for the
    first time; (bso#15318).
  * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings;
    (bso#15319).
  * net ads search -P doesn't work against servers in other
    domains; (bso#15323).
  * DS ACEs might be inherited to unrelated object classes;
    (bso#15338).
  * Temporary smbXsrv_tcon_global.tdb can't be parsed;
    (bso#15353).
  * Setting veto files = /.*/ break listing directories;
    (bso#15360); (bsc#1212375).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
  * dsgetdcname: assumes local system uses IPv4; (bso#15325).</changelog>
  <changelog author="nopower@suse.com" date="1688644800">- Update to 4.17.9
  * Backport --pidl-developer fixes; (bso#15404).
  * smbd_scavenger crashes when service smbd is stopped;
    (bso#15275).
  * vfs_fruit might cause a failing open for delete; (bso#15378).
  * named crashes on DLZ zone update; (bso#14030).
  * winbind recurses into itself via rpcd_lsad; (bso#15361).
  * cli_list loops 100% CPU against pre-lanman2 servers;
    (bso#15382).
  * smbclient leaks fds with showacls; (bso#15391).
  * aes256 smb3 encryption algorithms are not allowed in
    smb3_sid_parse(); (bso#15374).
  * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR;
    (bso#15413).
  * smbget memory leak if failed to download files recursively;
    (bso#15403).</changelog>
  <changelog author="nopower@suse.com" date="1689249600">- CVE-2022-2127: lm_resp_len not checked properly in
  winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
- CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
  Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
- CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
  Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
- CVE-2023-34968: Spotlight server-side Share Path Disclosure;
  (bso#15388); (bsc#1213171).
- CVE-2023-3347: Samba doesn't require SMB2+ signing if
  `server signing = mandatory` is set; (bso#15397); (bsc#1213170).</changelog>
  <changelog author="nopower@suse.com" date="1689595200">- secure channel faulty since Windows 10/11 update 07/2023;
  (bso#15418); (bsc#1213384).</changelog>
  <changelog author="scabrero@suse.de" date="1690891200">- net ads lookup with unspecified realm fails; (bso#15384);
  (bsc#1213826);</changelog>
  <changelog author="scabrero@suse.de" date="1691496000">- Move libcluster-samba4.so from samba-libs to samba-client-libs;
  (bsc#1213940);</changelog>
  <changelog author="scabrero@suse.de" date="1692014400">- Fix DFS not working with widelinks enabled; (bsc#1213607);
  (bso#15435);</changelog>
  <changelog author="nopower@suse.com" date="1696420800">- CVE-2023-4091: samba: Client can truncate file with read-only
  permissions; (bsc#1215904); (bso#15439).
- CVE-2023-42669: samba: rpcecho, enabled and running in AD DC,
  allows blocking sleep on request; (bso#1215905); (bso#15474).
- CVE-2023-42670: samba:  The procedure number is out of range
  when starting Active Directory Users and Computers;
  (bsc#1215906); (bso#15473).
- CVE-2023-3961: samba: Unsanitized client pipe name passed to
  local_np_connect(); (bsc#1215907); (bso#15422).
- CVE-2023-4154: samba: dirsync allows SYSTEM access with only
  "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES;
  (bsc#1215908); (bso#15424).</changelog>
</package>
<package pkgid="e98de9324cf4595ff81a5d2621b6ee9b0259394c5e0901ed54a63c245cfe6a60" name="samba-client-libs" arch="x86_64">
  <version epoch="0" ver="4.17.9+git.421.abde31ca5c2" rel="150500.3.11.1"/>
  <changelog author="nopower@suse.com" date="1664452800">- Update to 4.15.10
  * Possible use after free of connection_struct when iterating
    smbd_server_connection-&gt;connections; (bso#15128);
    (bsc#1200102).
  * smbXsrv_connection_shutdown_send result leaked; (bso#15174).
  * Spotlight RPC service returns wrong response when Spotlight
    is disabled on a share; (bso#15086).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1;
    (bso#15153).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * Missing READ_LEASE break could cause data corruption;
    (bso#15148).
  * rpcclient can crash using setuserinfo(2); (bso#15124).
  * Samba fails to build with glibc 2.36 caused by including
    &lt;sys/mount.h&gt; in libreplace; (bso#15132).
  * SMB1 negotiation can fail to handle connection errors;
    (bso#15152).
  * samba-tool domain join segfault when joining a samba ad
    domain; (bso#15078).
- Update to 4.15.9
  * CVE-2022-32742:SMB1 code does not correct verify SMB1write,
    SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085);
    (bsc#1201496).
  * CVE-2022-32746: samba: Use-after-free occurring in database
    audit logging; (bso#15009); (bso#15096); (bsc#1201490).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32745: samba: ldb: AD users can crash the server
    process with an LDAP add or modify request; (bso#15008);
    (bso#15096); (bsc#1201492).
  * CVE-2022-2031: samba, ldb: AD users can bypass certain
    restrictions associated with changing passwords; (bso#15047);
    (bsc#1201495);
  * CVE-2022-32744: samba, ldb: AD users can forge password change
    requests for any user; (bso#15074); (bso#15047); (bsc#1201493).</changelog>
  <changelog author="nopower@suse.com" date="1668600000">- Update to 4.15.12
  * CVE-2022-42898: samba: heimdal: Samba buffer overflow
    vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126).
- Update to 4.15.11
  * Allow rebuild of Centos 8 images after move to vault for
    Samba 4.15; (bso#15193).
  * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3();
    (bso#15134); (bsc#1204254)</changelog>
  <changelog author="scabrero@suse.de" date="1669636800">- Install a systemd drop-in file for named service to allow
  read/write access to the DLZ directory; (bsc#1201689);</changelog>
  <changelog author="dmulder@suse.com" date="1669896000">- Introduce without-smb1-server spec flag; (bsc#1205104);
- Update to 4.17.3
  * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit
    systems; (bsc#1205126); (bso#15203);
- Replace obsolete python-gpgme with python-gpg
  * Upstream replaced it in v4.9.5 -- bso#13728
- Update to 4.17.2
  * CVE-2022-3592 [SECURITY] samba: Wide links protection broken;
    (bso#15207); (bsc#1204499).
  * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal
    unwrap_des3();(bso#15134); (bsc#1204254).
- Update to 4.17.1
  * CVE-2021-20251 [SECURITY] Bad password count not incremented
    atomically; (bso#14611).
  * smbXsrv_connection_shutdown_send result leaked; (bso#15174).
  * Flush on a named stream never completes; (bso#15182).
  * Permission denied calling SMBC_getatr when file not exists;
    (bso#15195).
  * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later
    over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC;
    (bso#15189).
  * pytest: add file removal helpers for TestCaseInTempDir;
    (bso#15191).
  * CVE-2021-20251 [SECURITY] Bad password count not incremented
    atomically; (bso#14611).
  * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later
    over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC;
    (bso#15189).
  * Flush on a named stream never completes; (bso#15182).
  * vfs_gpfs silently garbles timestamps &gt; year 2106;
    (bso#15151).
  * CVE-2021-20251 [SECURITY] Bad password count not incremented
    atomically; (bso#14611).
  * multi-channel socket passing may hit a race if one of the
    involved processes already existed; (bso#15200).
  * memory leak on temporary of struct imessaging_post_state and
    struct tevent_immediate on struct imessaging_context (in
    rpcd_spoolss and maybe others); (bso#15201).
  * Since popt1.19 various use after free errors using result of
    poptGetArg are now exposed; (bso#15205); (boo#1204279).
  * Remove special case for O_CREAT in SMB_VFS_OPENAT from
    vfs_glusterfs; (bso#15192).
  * GETPWSID in memory cache grows indefinetly with each NTLM
    auth; (bso#15169).
  * CVE-2021-20251 [SECURITY] Bad password count not incremented
    atomically; (bso#14611).
- Install a systemd drop-in file for named service to allow
  read/write access to the DLZ directory; (bsc#1201689);
- Fix use after free errors resulting from using return of
  poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205).
- s3: smbd: Fix memory leak in
  smbd_server_connection_terminate_done(); (bso#15174).
- Disable SMB1 for tumbleweed builds.
- Update to 4.17.0
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1;
    (bso#15153).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * assert failed: !is_named_stream(smb_fname)") at
    ../../lib/util/fault.c:197; (bso#15161).
  * Cross-node multi-channel reconnects result in SMB2 Negotiate
    returning NT_STATUS_NOT_SUPPORTED; (bso#15159).
  * winbind at info level debug can coredump when processing
    wb_lookupusergroups; (bso#15160).
  * Make use of glfs_*at() API calls in vfs_glusterfs;
    (bso#15157).
  * Possible use after free of connection_struct when iterating
    smbd_server_connection-&gt;connections; (bso#15128).
  * `net usershare add` fails with flag works with --long but
    fails with -l; (bso#15145).
  * acl_xattr VFS module may unintentionally use filesystem
    permissions instead of ACL from xattr; (bso#15126).
  * Performance regression on contended path based operations;
    (bso#15125).
  * Missing READ_LEASE break could cause data corruption;
    (bso#15148).
  * libsamba-errors uses a wrong version number; (bso#15141).
  * SMB1 negotiation can fail to handle connection errors;
    (bso#15152).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * 4.17.rc1 still uses symlink-race prone unix_convert();
    (bso#15144).
  * Backport fileserver related changed to 4.17.0rc2;
    (bso#15146).
  * Manpage for smbstatus json is missing; (bso#15147).
  * Backport fileserver related changed to 4.17.0rc2;
    (bso#15146).
  * Performance regression on contended path based operations;
    (bso#15125).
  * Backport fileserver related changed to 4.17.0rc2;
    (bso#15146).
  * Fix issues found by coverity in smbstatus json code;
    (bso#15140).
  * Backport fileserver related changed to 4.17.0rc2;
    (bso#15146).
- Migration to /usr/etc: Saving user changed configuration files
  in /etc and restoring them while an RPM update.
- Update to 4.16.4
  * CVE-2022-2031: Samba AD users can bypass certain restrictions
    associated with changing passwords; (bsc#1201495); (bso#15047);
  * CVE-2022-32744: Samba AD users can forge password change
    requests for any user; (bsc#1201493); (bso#15074);
  * CVE-2022-32745: Samba AD users can crash the server process
    with an LDAP add or modify request; (bsc#1201492); (bso#15008);
  * CVE-2022-32746: Samba AD users can induce a use-after-free in
    the server process with an LDAP add or modify request;
    (bsc#1201490); (bso#15009);
  * CVE-2022-32742: Server memory information leak via SMB1;
    (bsc#1201496); (bso#15085);
- Update to 4.16.3
  * Using vfs_streams_xattr and deleting a file causes a panic;
    (bso#15099);
  * Add support for bind 9.18; (bso#14986);
  * logging dsdb audit to specific files does not work;
    (bso#15076);
  * Problem when winbind renews Kerberos; (bso#14979);
    (bsc#1196224);
  * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in
    developer mode; (bso#15095);
  * Crash in streams_xattr because fsp-&gt;base_fsp-&gt;fsp_name is
    NULL; (bso#15105);
  * Crash in rpcd_classic - NULL pointer deference in
    mangle_is_mangled(); (bso#15118);
  * smbclient commands del &amp; deltree fail with
    NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100);
    (bsc#1200556);
  * Fix check for chown when processing NFSv4 ACL; (bso#15120);
  * The pcap background queue process should not be stopped;
    (bso#15082);
  * testparm: Fix typo in idmap rangesize check; (bso#15097);
  * net ads info returns LDAP server and LDAP server name as
    null; (bso#15106);
  * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link;
    (bso#15108);
  * CTDB child process logging does not work as expected;
    (bso#15090);
- Update spec file to fix the optional Heimdal DC build
- Fix external trusts with MIT Kerberos 1.20
- Add missing samba-client requirement to samba-winbind package;
  (bsc#1198255);
- Move pdb backends from package samba-libs to package
  samba-client-libs and remove samba-libs requirement from
  samba-winbind; (bsc#1200964); (bsc#1198255);
- Add sysuser-shadow requirement for packages using
  systemd-sysusers
- Use the canonical realm name to refresh the Kerberos tickets;
  (bsc#1196224); (bso#14979);
- Moved logrotate files from user specific directory /etc/logrotate.d
  to vendor specific directory /usr/etc/logrotate.d.
- Update to 4.16.2
  * Use pathref fd instead of io fd in vfs_default_durable_cookie;
    (bso#15042);
  * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original
    file had been deleted; (bso#15069);
  * Reintroduce netgroups support; (bso#15087);
  * net ads info shows LDAP Server: 0.0.0.0 depending on contacted
    server; (bso#14674);
  * Update from 4.15  to 4.16 breaks discovery of [homes] on
    standalone server from Win and IOS; (bso#15062);
  * waf produces incorrect names for python extensions with Python
    3.11; (bso#15071);
  * smbclient -E doesn't work as advertised; (bso#15075);
  * The samba background daemon doesn't refresh the printcap cache
    on startup; (bso#15081);
  * Out-by-4 error in smbd read reply max_send clamp; (bso#14443);
- Fix samba4.blackbox.net_ads_dns_async test with bind9 &gt;= 9.17.7
- Support building with MIT Kerberos 1.20
- Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC;
  (CVE-2020-17049);
- Resource Based Constrained Delegation (RBCD) for Samba AD DC
- Support building with gcc 12.1
- Use requires_eq macro to require the libldb2 version available at
  samba-dsdb-modules build time; (bsc#1199362);
- Update to 4.16.1
  * Share and server swapped in smbget password prompt; (bso#14831);
  * Durable handles won't reconnect if the leased file is written to;
    (bso#15022);
  * rmdir silently fails if directory contains unreadable files and
    hide unreadable is yes; (bso#15023);
  * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information
    on renamed file handle; (bso#15038);
  * Need to describe --builtin-libraries= better (compare with
  - -bundled-libraries); (bso#8731);
  * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback;
    (bso#14957);
  * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes;
    (bso#15035);
  * PAM Kerberos authentication incorrectly fails with a clock skew
    error; (bso#15046);
  * Username map - samba erroneously applies unix group memberships
    to user account entries; (bso#15041);
  * KVNO off by 100000; (bso#14951);
  * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027);
  * vfs_gpfs recalls=no option prevents listing files; (bso#15055);
  * smbd doesn't handle UPNs for looking up names; (bso#15054);
- Update update-apparmor-samba-profile script, replace
  non-printable delimiter with more human readable separator as
  sed can accept separators that can appear in the input data.
- Fix update-apparmor-samba-profile script, sed doesn't like
  multibyte separators; (bsc#1198309).
- Update to 4.16.0
  * New samba-dcerpcd binary to provide DCERPC in the member server
    setup
  * Certificate Auto Enrollment
  * Ability to add ports to dns forwarder addresses in internal DNS
    backend
  * No longer using Linux mandatory locks for sharemodes
  * SMB1 protocol has been deprecated, particularly older dialects
  * SMB1 protocol SMBCopy command removed
  * SMB1 server-side wildcard expansion removed
- Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101);
- Use systemd-sysusers to create system users; (bsc#1182847);</changelog>
  <changelog author="scabrero@suse.de" date="1671105600">- Update to 4.17.4
  * CVE-2022-44640 Upstream Heimdal free of user-controlled
    pointer in FAST; (bsc#14929);
  * CVE-2021-20251 Bad password count not incremented atomically;
    (bsc#14611);
  * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability;
    (bsc#15203);
  * CVE-2022-37966 rc4-hmac Kerberos session keys issued to
    modern servers; (bso#15237);
  * CVE-2022-37967 Kerberos constrained delegation ticket forgery
    possible against Samba AD DC; (bso#15231);
  * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak
    and should be avoided; (bso#15240);
  * pam_winbind uses time_t and pointers assuming they are of the
    same size; (bso#15224);
  * Heimdal session key selection in AS-REQ examines wrong entry;
    (bso#15219);
  * filter-subunit is inefficient with large numbers of
    knownfails; (bso#15258);
  * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories;
    (bso#15252);
  * The KDC logic arround msDs-supportedEncryptionTypes differs
    from Windows; (bso#13135);
  * libnet: change_password() doesn't work with
    dcerpc_samr_ChangePasswordUser4(); (bso#15206);
  * Heimdal session key selection in AS-REQ examines wrong entry;
    (bso#15219);
  * Memory leak in snprintf replacement functions; (bso#15230);
  * RODC doesn't reset badPwdCount reliable via an RWDC
    (CVE-2021-20251 regression); (bso#15253);
  * Prevent EBADF errors with vfs_glusterfs; (bso#15198);
  * %U for include directive doesn't work for share listing
    (netshareenum); (bso#15243);
  * Stack smashing in net offlinejoin requestodj; (bso#15257);
  * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue;
    (bso#15197);
  * Heimdal session key selection in AS-REQ examines wrong entry;
    (bso#15219);
- Remove deprecated if-{down,up} scripts; (bsc#1206444);
- Adjust the systemd drop-in file for named service; (bsc#1201689);
  * Paths are additive so do not repeat paths from named.service
  * Prefix the samba DLZ directory with "-" to ignore this path
    if it does not exists</changelog>
  <changelog author="nopower@suse.com" date="1671624000">- Change with_dc default to 0 (for non TW builds), ADDC feature is
  deprecated and will no longer be included in &gt;= SLE15-SP5;
  (jsc#PED-1122).</changelog>
  <changelog author="nopower@suse.com" date="1673524800">- Clean up logic for PAM migration settings in spec file.</changelog>
  <changelog author="nopower@suse.com" date="1674475200">- libdsdb-module-samba4 should be packaged as part of samba-libs and
  not samba-ad-dc-libs. Additionally no need for it to be
  removed conditionally.</changelog>
  <changelog author="nopower@suse.com" date="1674475201">- Remove non functioning ifup/ifdown samba-winbindd scripts;
  (bsc#1207414).</changelog>
  <changelog author="nopower@suse.com" date="1678363200">- Make samba-libs conflict with old samba-ad-dc-libs package
  to satisfy installcheck.</changelog>
  <changelog author="nopower@suse.com" date="1679745600">- Make (32bit) samba-libs conflict with old samba-ad-dc-libs
  package to satisfy installcheck.</changelog>
  <changelog author="nopower@suse.com" date="1681300800">- Update to 4.17.7
  * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords
    in cleartext; (bso#15315); (bsc#1209481).
  * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be
    deleted by unprivileged authenticated users; (bso#15276);
    (bsc#1209483).
  * CVE-2023-0614: samba: Access controlled AD LDAP attributes can
    be discovered; (bso#15270); (bsc#1209485).
  * large_ldap test is inefficient; (bso#15332).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
- Update to 4.17.6
  * streams_xattr is creating unexpected locks on folders;
    (bso#15314).
  * Use of the Azure AD Connect cloud sync tool is now supported
    for password hash synchronisation, allowing Samba AD Domains
    to synchronise passwords with this popular cloud environment;
    (bso#10635).
  * Spotlight doesn't work with latest macOS Ventura;
    (bso#15299).
  * New samba-dcerpc architecture does not scale gracefully;
    (bso#15310).
  * vfs_ceph incorrectly uses fsp_get_io_fd() instead of
    fsp_get_pathref_fd() in close and fstat; (bso#15307).
  * With clustering enabled samba-bgqd can core dump due to use
    after free; (bso#15293).
  * fd_load() function implicitly closes the fd where it should
    not; (bso#15311).
- Update to 4.17.5
  * smbc_getxattr() return value is incorrect; (bso#14808).
  * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not
    handled correctly; (bso#15172).
  * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210).
  * samba-tool gpo listall fails IPv6 only - finddcs() fails to
    find DC when there is only an AAAA record for the DC in DNS;
    (bso#15226).
  * smbd crashes if an FSCTL request is done on a stream handle;
    (bso#15236).
  * DFS links don't work anymore on Mac clients since 4.17;
    (bso#15277).
  * vfs_virusfilter segfault on access, directory edgecase
    (accessing NULL value); (bso#15283).
  * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5)
    based SChannel on NETLOGON (additional changes); (bso#15240).
  * %U for include directive doesn't work for share listing
    (netshareenum); (bso#15243).
  * Shares missing from netshareenum response in samba 4.17.4;
    (bso#15266).
  * ctdb: use-after-free in run_proc; (bso#15269).
  * irpc_destructor may crash during shutdown; (bso#15280).
  * auth3_generate_session_info_pac leaks wbcAuthUserInfo;
    (bso#15286).
  * smbclient segfaults with use after free on an optimized
    build; (bso#15268).
  * smbstatus leaking files in msg.sock and msg.lock;
    (bso#15282).
  * Leak in wbcCtxPingDc2; (bso#15164).
  * Access based share enum does not work in Samba 4.16+;
    (bso#15265).
  * Crash during share enumeration; (bso#15267).
  * rep_listxattr on FreeBSD does not properly check for reads
    off end of returned buffer; (bso#15271).
  * Avoid relying on C89 features in a few places; (bso#15281).</changelog>
  <changelog author="nopower@suse.com" date="1686830400">- Update to 4.17.8
  * log flood: smbd_calculate_access_mask_fsp: Access denied:
    message level should be lower; (bso#15302).
  * Floating point exception (FPE) via cli_pull_send at
    source3/libsmb/clireadwrite.c; (bso#15306).
  * test_tstream_more_tcp_user_timeout_spin fails intermittently
    on Rackspace GitLab runners; (bso#15328).
  * Reduce flapping of ridalloc test; (bso#15329).
  * large_ldap test is unreliable; (bso#15351).
  * New filename parser doesn't check veto files smb.conf
    parameter; (bso#15143).
  * mdssvc may crash when initializing; (bso#15354).
  * Large directory optimization broken for non-lcomp path
    elements; (bso#15313).
  * streams_depot fails to create streams; (bso#15357).
  * shadow_copy2 and streams_depot don't play well together;
    (bso#15358).
  * wbinfo -u fails on ad dc with &gt;1000 users; (bso#15366).
  * winbindd idmap child contacts the domain controller without a
    need; (bso#15317).
  * idmap_autorid may fail to map sids of trusted domains for the
    first time; (bso#15318).
  * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings;
    (bso#15319).
  * net ads search -P doesn't work against servers in other
    domains; (bso#15323).
  * DS ACEs might be inherited to unrelated object classes;
    (bso#15338).
  * Temporary smbXsrv_tcon_global.tdb can't be parsed;
    (bso#15353).
  * Setting veto files = /.*/ break listing directories;
    (bso#15360); (bsc#1212375).
  * CVE-2020-25720 [SECURITY] Create Child permission should not
    allow full write to all attributes (additional changes);
    (bso#14810).
  * dsgetdcname: assumes local system uses IPv4; (bso#15325).</changelog>
  <changelog author="nopower@suse.com" date="1688644800">- Update to 4.17.9
  * Backport --pidl-developer fixes; (bso#15404).
  * smbd_scavenger crashes when service smbd is stopped;
    (bso#15275).
  * vfs_fruit might cause a failing open for delete; (bso#15378).
  * named crashes on DLZ zone update; (bso#14030).
  * winbind recurses into itself via rpcd_lsad; (bso#15361).
  * cli_list loops 100% CPU against pre-lanman2 servers;
    (bso#15382).
  * smbclient leaks fds with showacls; (bso#15391).
  * aes256 smb3 encryption algorithms are not allowed in
    smb3_sid_parse(); (bso#15374).
  * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR;
    (bso#15413).
  * smbget memory leak if failed to download files recursively;
    (bso#15403).</changelog>
  <changelog author="nopower@suse.com" date="1689249600">- CVE-2022-2127: lm_resp_len not checked properly in
  winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
- CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
  Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
- CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
  Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
- CVE-2023-34968: Spotlight server-side Share Path Disclosure;
  (bso#15388); (bsc#1213171).
- CVE-2023-3347: Samba doesn't require SMB2+ signing if
  `server signing = mandatory` is set; (bso#15397); (bsc#1213170).</changelog>
  <changelog author="nopower@suse.com" date="1689595200">- secure channel faulty since Windows 10/11 update 07/2023;
  (bso#15418); (bsc#1213384).</changelog>
  <changelog author="scabrero@suse.de" date="1690891200">- net ads lookup with unspecified realm fails; (bso#15384);
  (bsc#1213826);</changelog>
  <changelog author="scabrero@suse.de" date="1691496000">- Move libcluster-samba4.so from samba-libs to samba-client-libs;
  (bsc#1213940);</changelog>
  <changelog author="scabrero@suse.de" date="1692014400">- Fix DFS not working with widelinks enabled; (bsc#1213607);
  (bso#15435);</changelog>
  <changelog author="nopower@suse.com" date="1696420800">- CVE-2023-4091: samba: Client can truncate file with read-only
  permissions; (bsc#1215904); (bso#15439).
- CVE-2023-42669: samba: rpcecho, enabled and running in AD DC,
  allows blocking sleep on request; (bso#1215905); (bso#15474).
- CVE-2023-42670: samba:  The procedure number is out of range
  when starting Active Directory Users and Computers;
  (bsc#1215906); (bso#15473).
- CVE-2023-3961: samba: Unsanitized client pipe name passed to
  local_np_connect(); (bsc#1215907); (bso#15422).
- CVE-2023-4154: samba: dirsync allows SYSTEM access with only
  "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES;
  (bsc#1215908); (bso#15424).</changelog>
</package>
<package pkgid="2c0e84936cf8cd48a124a17394eb7cf8ccf579ed008da2e414dc18cb5388d7ab" name="sssd" arch="aarch64">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="427dc420738579185b669667178b4235f4e7d03cb90f1c7c33e45f8a948c3c38" name="sssd" arch="s390x">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="2ddca0f8d7da6f0978a761c6d95000b9116ad0d39a43ac9b9d988ce5c7f4d725" name="sssd" arch="src">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="9c60dd4eff9f0811aa04674010bc31f24a9f59ecd188cce7e45499e0db6c5752" name="sssd" arch="x86_64">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="99e6256e6a3653ef6ccb73eb6d2ed6ab676b1021eea6da5cc7ddc4e76ba18595" name="sssd-common" arch="aarch64">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="b9385ed65b002efcc3088d9b8c52cc71f4b4884b6d3eb3a31f4ada16ad4ed0b5" name="sssd-common" arch="s390x">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="c26fe05d9adc4ceaa89297b135ef514053f666145fddad06b4ba92fe54d1a545" name="sssd-common" arch="x86_64">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="1997e0f979575057935d08e192f7ff18d1f1c87769128520cafc9e2cf8f8c58a" name="sssd-krb5-common" arch="aarch64">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="3a9d7aab158b276534ecbdb5ec18bcdb622ff55fe879029921ef0ca28093d727" name="sssd-krb5-common" arch="s390x">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="f0acadcd08696c977f2811671d0a0da534feb5e22e45b9452d57b051f5407c27" name="sssd-krb5-common" arch="x86_64">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="6d0ac03638fd7e7f1a3063de3ae205ceb3d12c78754b000f2eb414c9ef488545" name="sssd-ldap" arch="aarch64">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="6497ce29e71e0f4f79b5e4b17dfd24f98b530ec643112320d2795fb0dd82d990" name="sssd-ldap" arch="s390x">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="c3c01d98124075b8caa1800a7dfa6804bdc74d2879c6e3255dbdabe6d2aa6ed3" name="sssd-ldap" arch="x86_64">
  <version epoch="0" ver="2.5.2" rel="150500.10.6.1"/>
  <changelog author="scabrero@suse.de" date="1579176000">- Install infopipe dbus service (bsc#1106598)</changelog>
  <changelog author="scabrero@suse.de" date="1583755200">- Update samba secrets after changing machine password; (jsc#SLE-11503);
  Add 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch</changelog>
  <changelog author="scabrero@suse.de" date="1585310400">- Fix dynamic DNS updates not using FQDN (bsc#1160587); Add
  0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch</changelog>
  <changelog author="scabrero@suse.de" date="1601467200">- Fix build against samba &gt;= 4.12
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
- Fix build with curl &gt;= 7.62.0
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch</changelog>
  <changelog author="scabrero@suse.de" date="1616155200">- Fix a dependency loop by moving internal libraries to sssd-common
  package; (bsc#1182058);</changelog>
  <changelog author="scabrero@suse.de" date="1617796800">- Move sssctl command from sssd to sssd-tools package; (bsc#1184289);</changelog>
  <changelog author="scabrero@suse.de" date="1618488000">- Create timestamp attribute in cache objects if missing;
  (bsc#1182637); Add 0038-CACHE-Create-timestamp-if-missing.patch</changelog>
  <changelog author="scabrero@suse.de" date="1619524800">- Use /run instead of /var/run for daemon PID files; (bsc#1185185);</changelog>
  <changelog author="scabrero@suse.de" date="1622548800">- Fix sss_cache spurious error messages when invoked from shadow-utils;
  (bsc#1185017); Add 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1628769600">- Update to version 2.5.2; (jsc#SLE-17763);
  * originalADgidNumber attribute in the SSSD cache is now indexed.
  * Add new config option fallback_to_nss.
- Changes from version 2.5.1
  * auto_private_groups option can be set centrally through ID
    range setting in IPA (see ipa idrange commands family). This
    feature requires SSSD update on both client and server. This
    feature also requires freeipa 4.9.4 and newer.
  * Fix getsidbyname issues with IPA users with a user-private-group.
  * Default value of ldap_sudo_random_offset changed to 0
    (disabled). This makes sure that sudo rules are available as
    soon as possible after SSSD start in default configuration.
- Changes from version 2.5.0
  * Added support for automatic renewal of renewable TGTs that
    are stored in KCM ccache. This can be enabled by setting
    tgt_renewal = true. See the sssd-kcm man page for more
    details. This feature requires MIT Kerberos
    krb5-1.19-0.beta2.3 or higher.
  * Backround sudo periodic tasks (smart and full refresh) periods are
    now extended by a random offset to spread the load on the server in
    environments with many clients.
  * Completing a sudo full refresh now postpones the smart refresh by
    ldap_sudo_smart_refresh_interval value. This ensure that the smart
    refresh is not run too soon after a successful full refresh.
  * If debug_backtrace_enabled is set to true then on any error all prior
    debug messages (to some limit) are printed even if debug_level is set
    to low value.
  * Besides trusted domains known by the forest root, trusted domains known
    by the local domain are used as well.
  * New configuration option offline_timeout_random_offset to control random
    factor in backend probing interval when SSSD is in offline mode.
  * ad_gpo_implicit_deny is now respected even if there are no
    applicable GPOs present.
  * During the IPA subdomains request a failure in reading a single specific
    configuration option is not considered fatal and the request will
    continue.
  * Unknown IPA id-range types are not considered as an error
- Changes from version 2.4.2
  * Default value of "user" config option was fixed into
    accordance with man page, i.e. default is "root".
  * pam_sss_gss now support authentication indicators to further
    harden the authentication.
- Changes from version 2.4.1
  * New PAM module pam_sss_gss for authentication using GSSAPI.
  * case_sensitive=Preserving can now be set for trusted domains
    with AD and IPA providers.
  * krb5_use_subdomain_realm=True can now be used when sub-domain
    user principal names have upnSuffixes which are not known in
    the parent domain. SSSD will try to send the Kerberos request
    directly to a KDC of the sub-domain.
  * SYSLOG_IDENTIFIER was renamed to SSSD_PRG_NAME in journald
    output, to avoid issues with PID parsing in rsyslog
    (BSD-style forwarder) output.
  * Added pam_gssapi_check_upn to enforce authentication only
    with principal that can be associated with target user.
  * Added pam_gssapi_services to list PAM services that can
    authenticate using GSSAPI.
- Changes from version 2.4.0
  * Session recording can now exclude specific users or groups
    when scope is set to all (see exclude_users and
    exclude_groups options).
  * Active Directory provider now sends CLDAP pings over UDP
    protocol to Domain Controllers in parallel to determine site
    and forest to speed up server discovery.
- Changes from version 2.3.1
  * Domains can be now explicitly enabled or disabled using
    enable option in domain section. This can be especially used
    in configuration snippets.
  * New configuration options memcache_size_passwd,
    memcache_size_group, memcache_size_initgroups that can be
    used to control memory cache size.
  * Fixed several regressions in GPO processing introduced in
    sssd-2.3.0
  * Fixed regression in PAM responder: failures in cache only
    lookups are no longer considered fatal.
  * Fixed regression in proxy provider: pwfield=x is now default
    value only for sssd-shadowutils target.
- Changes from version 2.3.0
  * SSSD can now handle hosts and networks nsswitch databases
    (see resolve_provider option).
  * By default, authentication request only refresh user's
    initgroups if it is expired or there is not active user's
    session (see pam_initgroups_scheme option).
  * OpenSSL is used as default crypto provider, NSS is deprecated.
  * The AD provider now defaults to GSS-SPNEGO SASL mechanism
    (see ldap_sasl_mech option).
  * The AD provider can now be configured to use only ldaps port
    (see ad_use_ldaps option).
  * SSSD now accepts host entries from GPO's security filter.
  * New debug level (0x10000) added for low level LDB messages
    only (see sssd.conf man page).
- Changes from version 2.2.3
  * allow_missing_name now treats empty strings the same as
    missing names.
  * "soft_ocsp" and "soft_crl" options have been added to make
    the checks for revoked certificates more flexible if the
    system is offline.
  * Smart card authentication in polkit is now allowed by default.
  * Handling of FreeIPA users and groups containing ‘@’ sign now works.
  * Issue when autofs was unable to mount shares was fixed.
  * SSSD was unable to hande ldap_uri containing URIs with
    different port numbers, which has been rectified.
- Changes from version 2.2.2
  * Removing domain from ad_enabled_domain was not reflected in SSSD’s cache.
    This has been fixed.
  * Because of a race condition SSSD could crash during shutdown. The race
    condition was fixed.
  * Fixed a bug that limited number of external groups fetched by SSSD
    to 2000.
  * pam_sss now properly creates gnome keyring during login.
  * SSSD with KCM could wrongly pick older ccache instead of the latest one
    after login. This was fixed.
- Changes from version 2.2.1
  * New options were added which allow sssd-kcm to handle bigger data.
  * SSSD can now automatically refresh cached user data from subdomains
    in IPA/AD trust.
  * Fixed issue with SSSD hanging when connecting to non-responsive server
    with ldaps://.
  * SSSD is now restarted by systemd after crashes.
  * Fixed refression when dyndns_update was set to True and
    dyndns_refresh_interval was not set or set to 0 then DNS records were
    not updated at all.
  * Fixed issue when default_domain_suffix was used with files provider
    and caused all results from files domain to be fully qualified.
  * Fixed issue with sudo rules not being visible on OpenLDAP servers
  * Fixed crash with auth_provider = proxy that prevented logins
- Changes from version 2.2.0
  * The Kerberos provider can now include more KDC addresses or
    host names when writing data for the Kerberos locator plugin.
  * The 2FA prompting can now be configured.
  * The LDAP authentication provider now allows to use a
    different method of changing LDAP passwords using a modify
    operation in addition to the default extended operation.
  * The "auto_private_groups" configuration option now takes a
    new value hybrid.
  * A new option "ad_gpo_ignore_unreadable" was added.
  * The "cached_auth_timeout" parameter is now inherited by
    trusted domains.
  * The "ldap_sasl_mech" option now accepts another mechanism
    "GSS-SPNEGO" in addition to "GSSAPI".
  * The sssctl tool has two new commands, "cert-show" and "cert-map".
- Changes from version 2.1.0
  * Any provider can now match and map certificates to user identities.
  * pam_sss can now be configured to only perform Smart Card
    authentication or return an error if this is not possible.
  * pam_sss can also prompt the user to insert a Smart Card if,
    during an authentication it is not available.
  * It is now possible to refresh the KCM configuration without restarting
    the whole SSSD deamon
  * A new configuration option ad_gpo_implicit_deny was added.
    This option (when set to True) can be used to deny access to
    users even if there is not applicable GPO.
  * The dynamic DNS update can now batch DNS updates to include
    all address family updates in a single transaction.
- Changes from version 2.0.0
  * The Python API for managing users and groups in local domains
    (id_provider=local) was removed completely. The local
    provider (id_provider=local) and the command line tools to
    manage users and groups in the local domains, such as
    sss_useradd is not built anymore.
  * The LDAP provider had a special-case branch for evaluating
    group memberships with the RFC2307bis schema when group
    nesting was explicitly disabled. This codepath is removed.
  * The ldap_groups_use_matching_rule_in_chain and
    ldap_initgroups_use_matching_rule_in_chain options and the code
    that evaluated them was removed.
  * The "ldap_sudo_include_regexp" option changed its default
    value from true to false. Wildcards in the sudoHost LDAP
    attribute are no longer evaluated. This was costly to
    evaluate on the LDAP server side and at the same time rarely
    used.
  * The KCM responder has a new back end to store credential caches
    in a local database
  * The list of PAM services which are allowed to authenticate
    using a Smart Card is now configurable using a new option
    pam_p11_allowed_services.
- Make cifs-idmap plugin (idmapwb.so) use update-alternatives
  mechanism to be able to switch between cifs-utils and sssd;
  (bsc#1182682).
- Build sssd's KCM
- Drop obsolete patches:
  + 0001-SUDO-Create-the-socket-with-stricter-permissions.patch
  + 0002-intg-Do-not-hardcode-nsslibdir.patch
  + 0003-MONITOR-Do-not-use-two-configuration-databases.patch
  + 0004-Strip-whitespaces-in-netgroup-triple.patch
  + 0005-nss-sssd-returns-for-emtpy-home-directories.patch
  + 0006-Rotate-child-log-files.patch
  + 0007-nss-add-a-netgroup-counter-to-struct-nss_enum_index.patch
  + 0008-nss-initialize-nss_enum_index-in-nss_setnetgrent.patch
  + 0009-NSS-nss_clear_netgroup_hash_table-do-not-free-data.patch
  + 0010-SUDO-Allow-defaults-sudoRole-without-sudoUser-attrib.patch
  + 0011-GPO-Add-option-ad_gpo_ignore_unreadable.patch
  + 0012-nss-use-enumeration-context-as-talloc-parent-for-cac.patch
  + 0013-Revert-LDAP-IPA-add-local-email-address-to-aliases.patch
  + 0014-util-Remove-the-unused-function-is_email_from_domain.patch
  + 0015-MONITOR-Propagate-error-when-resolv.conf-does-not-ex.patch
  + 0016-MONITOR-Add-a-new-option-to-control-resolv.conf-moni.patch
  + 0017-MONITOR-Resolve-symlinks-setting-the-inotify-watcher.patch
  + 0018-SYSDB-Delete-linked-local-user-overrides-when-deleti.patch
  + 0019-winbind-idmap-plugin-support-inferface-version-6.patch
  + 0020-winbind-idmap-plugin-fix-detection.patch
  + 0021-nss-imap-add-sss_nss_getsidbyuid-and-sss_nss_getsidb.patch
  + 0022-cifs-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0023-winbind-idmap-plugin-use-new-sss_nss_idmap-calls.patch
  + 0024-libwbclient-sssd-use-new-sss_nss_idmap-calls.patch
  + 0025-pysss_nss_idmap-add-python-bindings-for-new-sss_nss_.patch
  + 0026-winbind-idmap-plugin-update-struct-idmap_domain-to-l.patch
  + 0027-utils-make-N_ELEMENTS-public.patch
  + 0028-ad-replace-ARRAY_SIZE-with-N_ELEMENTS.patch
  + sssd-gpo_host_security_filter-1.16.1.patch
  + 0001-Resolve-computer-lookup-failure-when-sam-cn.patch
  + 0031-ad-Add-support-for-passing-add-samba-data-to-adcli.patch
  + 0032-AD-use-getaddrinfo-with-AI_CANONNAME-to-find-the-FQD.patch
  + 0033-Fix-build-failure-against-samba-4.12.0rc1.patch
  + 0034-Use-ndr_pull_steal_switch_value-for-modern-samba-ver.patch
  + 0035-ad_gpo_ndr.c-refresh-ndr_-methods-from-samba-4.12.patch
  + 0036-ad_gpo_ndr.c-more-ndr-updates.patch
  + 0037-UTIL-Fix-compilation-with-curl-7.62.0.patch
  + 0038-CACHE-Create-timestamp-if-missing.patch
  + 0039-sss_cache-Do-not-fail-for-missing-domains.patch</changelog>
  <changelog author="scabrero@suse.de" date="1641902400">- Remove libsmbclient-devel BuildRequires in favor of
  pkgconfig(smbclient)</changelog>
  <changelog author="scabrero@suse.de" date="1642075200">- Update the private ldb modules installation following libldb2
  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba</changelog>
  <changelog author="scabrero@suse.de" date="1644408000">- Remove caches only when performing a package downgrade. The sssd
  daemon takes care of upgrading the database format when necessary
  (bsc#1195552)</changelog>
  <changelog author="scabrero@suse.de" date="1645444800">- Fix 32-bit libraries package. Libraries were moved from sssd to
  sssd-common to fix bsc#1182058 and baselibs.conf was not updated
  accordingly; (bsc#1196166);</changelog>
  <changelog author="scabrero@suse.de" date="1646049600">- Add 'ldap_ignore_unreadable_references' parameter to skip
  unreadable objects referenced by 'member' attributte;
  (bsc#1190775); (gh#SSSD/sssd#4893); Add patch
  0001-ldap-ignore-unreadable-references.patch</changelog>
  <changelog author="scabrero@suse.de" date="1647259200">- Fix shell command injection in sssctl via the logs-fetch and
  cache-expire subcommands; (CVE-2021-3621); (bsc#1189492); Add
  0002-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch</changelog>
  <changelog author="dmulder@suse.com" date="1664193600">- Fix sdap_access_host No matching host rule found;
  (bsc#1202559); Add patch
  0001-Fix-sdap_access_host-No-matching-host-rule-found.patch</changelog>
  <changelog author="scabrero@suse.de" date="1675944000">- Fix build with MIT 1.20; Add patch
  0004-BUILD-Accept-krb5-1.20-for-building-the-PAC-plugin.patch</changelog>
  <changelog author="nopower@suse.com" date="1690372800">- Fix sssd entering failed state under heavy load by adding
  watchdog to monitor sbus_call_DBus_Hello_send(); (bsc#1213283);
  Add patch 0001-sssd-watchdog.patch</changelog>
  <changelog author="scabrero@suse.de" date="1696248000">- ldap password policy: return failure if there are no grace logins
  left; (bsc#1214434); Add patch
  0006-ldap-return-failure-if-there-are-no-grace-logins-lef.patch</changelog>
</package>
<package pkgid="fa347d245fce780f2dd6e120479f406ef30241c32803fe273ebe3617e1cf4093" name="supportutils" arch="noarch">
  <version epoch="0" ver="3.1.26" rel="150300.7.35.21.1"/>
  <changelog author="jason.record@suse.com" date="1633348800">- Installing to /usr/sbin instead of /sbin (bsc#1191096)
- Added shared memory as a log directory for emergency use (bsc#1190943)</changelog>
  <changelog author="jason.record@suse.com" date="1634558400">- getappcore identifies compressed core files (bsc#1191794)</changelog>
  <changelog author="jason.record@suse.com" date="1637150400">- Merged Include udev rules in /lib/udev/rules.d/ #113
- Merged Move localmessage/warm logs out of messages.txt to new localwarn.txt #87</changelog>
  <changelog author="jason.record@suse.com" date="1639569600">- Changes to version 3.1.19
  + Removed chronyc DNS lookups with -n switch (bsc#1193732)</changelog>
  <changelog author="jason.record@suse.com" date="1641816000">- Changes to version 3.1.19
  + Made /proc directory and network names spaces configurable (bsc#1193868)</changelog>
  <changelog author="jason.record@suse.com" date="1646395200">- Changes to version 3.1.20
  + Added command blkid #114
  + Added s390x specific files and output #115
  + Fix for invalid argument during updates (bsc#1193204)
  + Optimized conf_files, conf_files_text and log_cmd functions #118
  + Fixed iscsi initiator name (bsc#1195797)
  + Added rpcinfo -p output #116
  + Included /etc/sssd/conf.d configuration files #100</changelog>
  <changelog author="jason.record@suse.com" date="1647345600">- Spec file adjusted for usr-merge</changelog>
  <changelog author="jason.record@suse.com" date="1654171200">- Added a listing to /dev/mapper/. #129</changelog>
  <changelog author="jason.record@suse.com" date="1666094400">- Changes to version 3.1.21
  + Added type output with df command in fs-diskio.txt (issue#141)
  + Gather all files in /etc/security/limits.d/ (issue#142)
  + Fixed KVM virtualization detection on bare metal (bsc#1184689)
  + Added logging using journalctl (bsc#1200330)
  + Passwords correctly removed from email.txt, updates.txt and fs-iscsi.txt (bsc#1203818)
  + Added system logging configuration and checking in messages_config.txt (issue#103)
  + If rsyslog not installed collect more from journalctl (issue#120)
  + Added systemd-status.txt for the status of all service units (issue#125)
  + autofs includes files in (+dir:&lt;path&gt;) (issue#111)
  + Get current sar data before collecting files (bsc#1192648)
  + Collects everything in /etc/multipath/ (bsc#1192252)
  + Collects power management information in hardware.txt (bsc#1197428)
  + Checks for suseconnect-ng or SUSEConnect packages (bsc#1202337)
  + Fixed conf_files and conf_text_files so y2log is gathered (issue#134, bsc#1202269)
  + Update to nvme_info and block_info #133 (bsc#1202417)
  + Added IO scheduler (issue#136)
  + Added includedir directories from /etc/sudoers (bsc#1188086)</changelog>
  <changelog author="jason.record@suse.com" date="1666094401">- Added lifecycle information (issue#140)</changelog>
  <changelog author="jason.record@suse.com" date="1668168000">- Changes to supportconfig version 3.1.11-46.3
  + Added missed sanitation check on crash.txt (bsc#1203818)
- Changes to supportconfig.rc version 3.1.11-30
  + Added check to _sanitize_file
  + Using variable for replement text in _sanitize_file</changelog>
  <changelog author="jason.record@suse.com" date="1668686400">- Changes to getappcore version 1.53.02
  + The location of chkbin was updated earlier. This documents that
    change (bsc#1205533, bsc#1204942)</changelog>
  <changelog author="jason.record@suse.com" date="1669982400">- Changes to supportconfig version 3.1.11-46.4
  + Added plymouth_info</changelog>
  <changelog author="jason.record@suse.com" date="1674734400">- Changes to supportconfig.rc version 3.1.11-35
  + Corrected _sanitize_file to include iscsi.conf and others (bsc#1206402)</changelog>
  <changelog author="hp.jansen@suse.com" date="1675339200">- Add dependency to `numactl` on ppc64le and `s390x`, this enforces
  that `numactl --hardware` data is provided in supportconfigs</changelog>
  <changelog author="jason.record@suse.com" date="1679313600">- Fixed missing status detail for apparmor (bsc#1196933)
- Corrected invalid argument list in docker.txt (bsc#1206608)
- Applies limit equally to sar data and text files (bsc#1207543)
- Collects hwinfo hardware logs (bsc#1208928)
- Collects lparnumascore logs (issue#148)</changelog>
  <changelog author="jason.record@suse.com" date="1685620800">- Changes for supportutils version 3.1.25
  + Removed iSCSI passwords CVE-2022-45154 (bsc#1207598)
  + powerpc: Collect lsslot,amsstat, and opal elogs (pr#149)
  + powerpc: collect invscout logs (pr#150)
  + powerpc: collect RMC status logs (pr#151)
  + Added missing nvme nbft commands (bsc#1211599)
  + Fixed invalid nvme commands (bsc#1211598)
  + Added missing podman information (PED-1703, bsc#1181477)
  + Removed dependency on sysfstools
  + Check for systool use (bsc#1210015)
  + Added selinux checking (bsc#1209979)
  + Updated SLES_VER matrix</changelog>
  <changelog author="jason.record@suse.com" date="1687780800">- ha_info sle15 uses /var/log/pacemaker/ (pq#153)</changelog>
  <changelog author="jason.record@suse.com" date="1690372800">- Added run time detection (bsc#1213127)</changelog>
  <changelog author="jason.record@suse.com" date="1693569600">- Changes in version 3.1.26
  + powerpc plugin to collect the slots and active memory (bsc#1210950)
  + A Cleartext Storage of Sensitive Information vulnerability CVE-2022-45154
  + supportconfig: collect BPF information (pr#154)
  + Added additional iscsi information (pr#155)</changelog>
</package>
<package pkgid="98526a7392af7f50212778dda9203c3a7d51dfbdd227c41f8c7751442dfa870d" name="supportutils" arch="src">
  <version epoch="0" ver="3.1.26" rel="150300.7.35.21.1"/>
  <changelog author="jason.record@suse.com" date="1633348800">- Installing to /usr/sbin instead of /sbin (bsc#1191096)
- Added shared memory as a log directory for emergency use (bsc#1190943)</changelog>
  <changelog author="jason.record@suse.com" date="1634558400">- getappcore identifies compressed core files (bsc#1191794)</changelog>
  <changelog author="jason.record@suse.com" date="1637150400">- Merged Include udev rules in /lib/udev/rules.d/ #113
- Merged Move localmessage/warm logs out of messages.txt to new localwarn.txt #87</changelog>
  <changelog author="jason.record@suse.com" date="1639569600">- Changes to version 3.1.19
  + Removed chronyc DNS lookups with -n switch (bsc#1193732)</changelog>
  <changelog author="jason.record@suse.com" date="1641816000">- Changes to version 3.1.19
  + Made /proc directory and network names spaces configurable (bsc#1193868)</changelog>
  <changelog author="jason.record@suse.com" date="1646395200">- Changes to version 3.1.20
  + Added command blkid #114
  + Added s390x specific files and output #115
  + Fix for invalid argument during updates (bsc#1193204)
  + Optimized conf_files, conf_files_text and log_cmd functions #118
  + Fixed iscsi initiator name (bsc#1195797)
  + Added rpcinfo -p output #116
  + Included /etc/sssd/conf.d configuration files #100</changelog>
  <changelog author="jason.record@suse.com" date="1647345600">- Spec file adjusted for usr-merge</changelog>
  <changelog author="jason.record@suse.com" date="1654171200">- Added a listing to /dev/mapper/. #129</changelog>
  <changelog author="jason.record@suse.com" date="1666094400">- Changes to version 3.1.21
  + Added type output with df command in fs-diskio.txt (issue#141)
  + Gather all files in /etc/security/limits.d/ (issue#142)
  + Fixed KVM virtualization detection on bare metal (bsc#1184689)
  + Added logging using journalctl (bsc#1200330)
  + Passwords correctly removed from email.txt, updates.txt and fs-iscsi.txt (bsc#1203818)
  + Added system logging configuration and checking in messages_config.txt (issue#103)
  + If rsyslog not installed collect more from journalctl (issue#120)
  + Added systemd-status.txt for the status of all service units (issue#125)
  + autofs includes files in (+dir:&lt;path&gt;) (issue#111)
  + Get current sar data before collecting files (bsc#1192648)
  + Collects everything in /etc/multipath/ (bsc#1192252)
  + Collects power management information in hardware.txt (bsc#1197428)
  + Checks for suseconnect-ng or SUSEConnect packages (bsc#1202337)
  + Fixed conf_files and conf_text_files so y2log is gathered (issue#134, bsc#1202269)
  + Update to nvme_info and block_info #133 (bsc#1202417)
  + Added IO scheduler (issue#136)
  + Added includedir directories from /etc/sudoers (bsc#1188086)</changelog>
  <changelog author="jason.record@suse.com" date="1666094401">- Added lifecycle information (issue#140)</changelog>
  <changelog author="jason.record@suse.com" date="1668168000">- Changes to supportconfig version 3.1.11-46.3
  + Added missed sanitation check on crash.txt (bsc#1203818)
- Changes to supportconfig.rc version 3.1.11-30
  + Added check to _sanitize_file
  + Using variable for replement text in _sanitize_file</changelog>
  <changelog author="jason.record@suse.com" date="1668686400">- Changes to getappcore version 1.53.02
  + The location of chkbin was updated earlier. This documents that
    change (bsc#1205533, bsc#1204942)</changelog>
  <changelog author="jason.record@suse.com" date="1669982400">- Changes to supportconfig version 3.1.11-46.4
  + Added plymouth_info</changelog>
  <changelog author="jason.record@suse.com" date="1674734400">- Changes to supportconfig.rc version 3.1.11-35
  + Corrected _sanitize_file to include iscsi.conf and others (bsc#1206402)</changelog>
  <changelog author="hp.jansen@suse.com" date="1675339200">- Add dependency to `numactl` on ppc64le and `s390x`, this enforces
  that `numactl --hardware` data is provided in supportconfigs</changelog>
  <changelog author="jason.record@suse.com" date="1679313600">- Fixed missing status detail for apparmor (bsc#1196933)
- Corrected invalid argument list in docker.txt (bsc#1206608)
- Applies limit equally to sar data and text files (bsc#1207543)
- Collects hwinfo hardware logs (bsc#1208928)
- Collects lparnumascore logs (issue#148)</changelog>
  <changelog author="jason.record@suse.com" date="1685620800">- Changes for supportutils version 3.1.25
  + Removed iSCSI passwords CVE-2022-45154 (bsc#1207598)
  + powerpc: Collect lsslot,amsstat, and opal elogs (pr#149)
  + powerpc: collect invscout logs (pr#150)
  + powerpc: collect RMC status logs (pr#151)
  + Added missing nvme nbft commands (bsc#1211599)
  + Fixed invalid nvme commands (bsc#1211598)
  + Added missing podman information (PED-1703, bsc#1181477)
  + Removed dependency on sysfstools
  + Check for systool use (bsc#1210015)
  + Added selinux checking (bsc#1209979)
  + Updated SLES_VER matrix</changelog>
  <changelog author="jason.record@suse.com" date="1687780800">- ha_info sle15 uses /var/log/pacemaker/ (pq#153)</changelog>
  <changelog author="jason.record@suse.com" date="1690372800">- Added run time detection (bsc#1213127)</changelog>
  <changelog author="jason.record@suse.com" date="1693569600">- Changes in version 3.1.26
  + powerpc plugin to collect the slots and active memory (bsc#1210950)
  + A Cleartext Storage of Sensitive Information vulnerability CVE-2022-45154
  + supportconfig: collect BPF information (pr#154)
  + Added additional iscsi information (pr#155)</changelog>
</package>
<package pkgid="027dc8cdc236ced2117f9b9cec2b1d8aa147db1b5de33d617b24c2ff1ca7c5a7" name="suse-build-key" arch="noarch">
  <version epoch="0" ver="12.0" rel="150000.8.34.1"/>
  <changelog author="ro@suse.de" date="1480420800">- use dumpsigs script from openSUSE to merge code</changelog>
  <changelog author="meissner@suse.com" date="1481112000">- extend the build@suse.de product key. (bsc#1014151)
  pub  2048R/39DB7C82 2013-01-31 [expires: 2020-12-06]
  uid                            SuSE Package Signing Key &lt;build@suse.de&gt;</changelog>
  <changelog author="meissner@suse.com" date="1522238400">- created a new security@suse.de communication key. (bsc#1082022)
- extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512)</changelog>
  <changelog author="meissner@suse.com" date="1542110400">- include ptf key in the key directory to avoid it being
  stripped via %doc stripping. (bsc#1044232)</changelog>
  <changelog author="meissner@suse.com" date="1583928000">- created a new security@suse.de communication key (bsc#1166334)</changelog>
  <changelog author="meissner@suse.com" date="1587643200">- add a /usr/share/container-keys/ directory for GPG based Container
  verification.
- Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347)</changelog>
  <changelog author="meissner@suse.com" date="1597320000">- actually the container key is different from the build signing
  key. (PM-1845 bsc#1170347)</changelog>
  <changelog author="meissner@suse.com" date="1600689600">- suse build key extended (bsc#1176759)
  gpg-pubkey-39db7c82-5847eb1f.asc -&gt; gpg-pubkey-39db7c82-5f68629b.asc</changelog>
  <changelog author="meissner@suse.com" date="1645099200">- extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc
- added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494)
- extended expiry of SUSE SLES11 key (bsc#1194845)
- added SUSE Contaner signing key in PEM format for use e.g. by cosign.
- SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495)</changelog>
  <changelog author="meissner@suse.com" date="1648123200">- No longer install 1024bit keys by default. (bsc#1197293)
  - SLE11 key moved to documentation
  - old PTF (pre March 2022) moved to documentation only</changelog>
  <changelog author="meissner@suse.com" date="1650542400">- still ship the old ptf key (was not added to documentation by mistake).
  (bsc#1198504)</changelog>
  <changelog author="meissner@suse.com" date="1666699200">- added /usr/share/pki/containers directory for container pem keys
  (cosign/sigstore style), put our PEM key there too (bsc#1204706)</changelog>
  <changelog author="meissner@suse.com" date="1675771200">- Establish multiple new 4096 RSA keys that we will switch
  to mid of 2023. (jsc#PED-2777)
  - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos).
  - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos).
  - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs.
  - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem:
    new RSA 4096 key for the SUSE registry registry.suse.com, installed as
    suse-container-key-2023.pem and suse-container-key-2023.asc
  - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem:
    New PTF container signing key for registry.suse.com/ptf/ space.</changelog>
  <changelog author="meissner@suse.com" date="1694174400">- add and run a import-suse-build-key scripts, this will be ran
  after installation with libzypp based installers. (jsc#PED-2777)</changelog>
</package>
<package pkgid="3a4908c7aabd1dbcb6bf9f54f1275a0395cb00fee42a97f78a26b547e1ab99b1" name="suse-build-key" arch="src">
  <version epoch="0" ver="12.0" rel="150000.8.34.1"/>
  <changelog author="ro@suse.de" date="1359633600">- added future signing key for SLES (fate#314767) (bnc#801055)
  using 2048 bit rsa key</changelog>
  <changelog author="meissner@suse.com" date="1389268800">- Merged over logic from openSUSE-build-key.
- Got rid of default importing into roots keyring.
- Removed some old keys.
- Clarify that security@suse.de is a email only key
- PTF key is supplied also as %doc, to not be default
  imported.
- Keys currently inside:
  - pub  2048R/39DB7C82 SuSE Package Signing Key &lt;build@suse.de&gt;
  - pub  2048R/50A3DD1C SuSE Package Signing Key (reserve key) &lt;build@suse.de&gt;
  - pub  1024D/B37B98A9 SUSE PTF Signing Key &lt;support@suse.com&gt;
  - pub  2048R/3D25D3D9 SuSE Security Team &lt;security@suse.de&gt;</changelog>
  <changelog author="meissner@suse.com" date="1389614400">- reverted to contain the fullkeyring build SLE12 Alpha.
- also list the old sle11 build@suse.de key temporary</changelog>
  <changelog author="meissner@suse.com" date="1392033600">- create suse-build-key.gpg during build.
- Remove old keys from keyring. (fate#314767)
  Keys currently inside the RPM trusted keyring:
  - pub  2048R/39DB7C82 SuSE Package Signing Key &lt;build@suse.de&gt;
  - pub  2048R/50A3DD1C SuSE Package Signing Key (reserve key) &lt;build@suse.de&gt;
- Various keys are moved to the documentation area
  (/usr/share/doc/packages/suse-build-key)
  - build-at-suse-sle11.asc: the old SUSE Linux Enterprise 11 key.
    if SUSE Linux Enterprise 11 packages need to be verified on
    a SUSE Linux Enterprise 12 system.
  - suse_ptf_key.asc: The suse ptf key. For verification of provided PTFs.
  - security_at_suse_de.asc: Use only for email encryption and
    verification purposes when contacting our security contact address
    security@suse.de</changelog>
  <changelog author="meissner@suse.com" date="1409313600">- Went to new method again.
  - suse-build-key.gpg blob dropped
  - ship seperate files</changelog>
  <changelog author="meissner@suse.com" date="1412251200">- renamed security_at_suse_de.asc to security_at_suse_de_old.asc
- security_at_suse_de.asc: new 4096 bit RSA key.
  pub  4096R/317CD502 2014-10-02 SUSE Security Team &lt;security@suse.de&gt;
  bnc#899509</changelog>
  <changelog author="ro@suse.de" date="1480420800">- use dumpsigs script from openSUSE to merge code</changelog>
  <changelog author="meissner@suse.com" date="1481112000">- extend the build@suse.de product key. (bsc#1014151)
  pub  2048R/39DB7C82 2013-01-31 [expires: 2020-12-06]
  uid                            SuSE Package Signing Key &lt;build@suse.de&gt;</changelog>
  <changelog author="meissner@suse.com" date="1522238400">- created a new security@suse.de communication key. (bsc#1082022)
- extended the PTF key and the SLE10 build@suse.de key. (bsc#1085512)</changelog>
  <changelog author="meissner@suse.com" date="1542110400">- include ptf key in the key directory to avoid it being
  stripped via %doc stripping. (bsc#1044232)</changelog>
  <changelog author="meissner@suse.com" date="1583928000">- created a new security@suse.de communication key (bsc#1166334)</changelog>
  <changelog author="meissner@suse.com" date="1587643200">- add a /usr/share/container-keys/ directory for GPG based Container
  verification.
- Add the SUSE build key as "suse-container-key.asc". (PM-1845 bsc#1170347)</changelog>
  <changelog author="meissner@suse.com" date="1597320000">- actually the container key is different from the build signing
  key. (PM-1845 bsc#1170347)</changelog>
  <changelog author="meissner@suse.com" date="1600689600">- suse build key extended (bsc#1176759)
  gpg-pubkey-39db7c82-5847eb1f.asc -&gt; gpg-pubkey-39db7c82-5f68629b.asc</changelog>
  <changelog author="meissner@suse.com" date="1645099200">- extended expiry of SUSE PTF key, move it to suse_ptf_key_old.asc
- added new SUSE PTF key with RSA2048 bit as suse_ptf_key.asc (bsc#1196494)
- extended expiry of SUSE SLES11 key (bsc#1194845)
- added SUSE Contaner signing key in PEM format for use e.g. by cosign.
- SUSE security key replaced with 2022 edition (E-Mail usage only). (bsc#1196495)</changelog>
  <changelog author="meissner@suse.com" date="1648123200">- No longer install 1024bit keys by default. (bsc#1197293)
  - SLE11 key moved to documentation
  - old PTF (pre March 2022) moved to documentation only</changelog>
  <changelog author="meissner@suse.com" date="1650542400">- still ship the old ptf key (was not added to documentation by mistake).
  (bsc#1198504)</changelog>
  <changelog author="meissner@suse.com" date="1666699200">- added /usr/share/pki/containers directory for container pem keys
  (cosign/sigstore style), put our PEM key there too (bsc#1204706)</changelog>
  <changelog author="meissner@suse.com" date="1675771200">- Establish multiple new 4096 RSA keys that we will switch
  to mid of 2023. (jsc#PED-2777)
  - gpg-pubkey-3fa1d6ce-63c9481c.asc: new 4096 RSA signing key for SLE (RPM+repos).
  - gpg-pubkey-d588dc46-63c939db.asc: new 4096 RSA reserver key for SLE (RPM+repos).
  - suse_ptf_key_4096.asc: new 4096 RSA signing key for PTF RPMs.
  - build-container-8fd6c337-63c94b45.asc/build-container-8fd6c337-63c94b45.pem:
    new RSA 4096 key for the SUSE registry registry.suse.com, installed as
    suse-container-key-2023.pem and suse-container-key-2023.asc
  - suse_ptf_containerkey_2023.asc suse_ptf_containerkey_2023.pem:
    New PTF container signing key for registry.suse.com/ptf/ space.</changelog>
  <changelog author="meissner@suse.com" date="1694174400">- add and run a import-suse-build-key scripts, this will be ran
  after installation with libzypp based installers. (jsc#PED-2777)</changelog>
</package>
<package pkgid="f5659ac7a096163413376b997eb1931afa77901b55bf00c04c3a24bbbc7d5cbf" name="suse-module-tools" arch="aarch64">
  <version epoch="0" ver="15.5.3" rel="150500.3.6.1"/>
  <changelog author="mwilck@suse.com" date="1623931200">- Update to version 15.3.7:
  * Fix treatment of compressed modules (bsc#1187093)</changelog>
  <changelog author="mwilck@suse.com" date="1625572800">- Update to version 15.3.8:
  * modprobe.d: Remove dma=none setting for parport_pc
    (bsc#1177695)</changelog>
  <changelog author="mwilck@suse.com" date="1628856000">- Update to version 15.4.2
- Move config files to /lib/modprobe.d and /lib/depmod.d
  (jsc#SLE-20639)
  * "modprobe $FS" for a blacklisted file system now offers to
    unblacklist the module permanently
  * disabled automatic un-blacklisting of filesystem modules loaded
    at installation time
- Replace mkinitrd with dracut everywhere (jsc#SLE-20348)
- Add faster substitute for lsinitrd to speed up weak-modules2
  (jsc#SLE-9078)
- Enable f2fs
- Add a "Supplements" dependency on dkms to the "legacy" submodule
  (dkms needs "weak-modules")
- modprobe.d cleanups and fixes:
  * Unify ppc64 and ppc64le
  * Delete files for obsolete architectures
  * Remove obsolete SUSE_INITRD statements (bsc#1161343)
  * Remove dma=none setting for parport_pc (bsc#1177695)
- Add README.md</changelog>
  <changelog author="mwilck@suse.com" date="1629374400">- Update to version 15.4.3:
  * fix problem that initrd may not be rebuilt after installing
    kernel-$flavor-extra (bsc#1189441)</changelog>
  <changelog author="mwilck@suse.com" date="1633089600">- Update to version 15.4.4:
  * Import kernel scriptlets from kernel-source
    (bsc#1189841, bsc#1190598)
  * Provide "suse-kernel-rpm-scriptlets"</changelog>
  <changelog author="mwilck@suse.com" date="1633348800">- Update to version 15.4.5:
  * inkmp-script(postun): don't pass  existing files to weak-modules2
    (boo#1191200)
  * kernel-scriptlets: skip cert scriptlet on non-UEFI systems
    (boo#1191260)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 15.4.6:
  * rpm-script: fix bad exit status in OpenQA (bsc#1191922)
  * cert-script: Deal with existing $cert.delete file (bsc#1191804).
  * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480).
  * cert-script: Only print mokutil output in verbose mode.</changelog>
  <changelog author="mwilck@suse.com" date="1634904001">- Update to version 15.4.7:
  * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)"</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Update to version 15.4.8:
  * Same as Factory version 16.0.14
  * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE).
    Both packages are now both obsoleted by suse-module-tools.
    (jsc#SLE-21032)
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="mwilck@suse.com" date="1639396800">- Update to version 15.4.9:
  * same as Factory version 16.0.16
  * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059)
  - Rather than shipping two large files with modprobe.d options
    (00-system.conf and 50-blacklist.conf), ship multiple small
    per-module files. This makes it easier for users to override
    distribution defaults.
  * blacklist isst_if_mbox_msr (bsc#1187196)
  * boot-sysctl: make sure file exists (fix for containers)
  * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718)</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">- Update to version 15.4.10:
  * same as Factory version 16.0.17
  * 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)
  * install some modprobe.d files only for relevant architectures
    (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974)</changelog>
  <changelog author="mwilck@suse.com" date="1641297600">- Update to version 15.4.11:
  * cdrom: Disable autoclose by default (boo#1165047).
  * Make regenerate-initrd-posttrans compatible with Dracut's
    UEFI mode (unified kernel image)</changelog>
  <changelog author="mwilck@suse.com" date="1643371200">- Update to version 15.4.12:
  * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051)
  * rpm-script: force-copy kernel to /boot (boo#1194501)</changelog>
  <changelog author="mwilck@suse.com" date="1667563200">- Update to version 15.4.13:
  * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- Update to version 15.4.14:
  * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423)</changelog>
  <changelog author="mwilck@suse.com" date="1669032001">- Update to version 15.4.15: Backport bug fixes from factory
  * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092)
  * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391)
  * driver-check.sh: avoid false positive error messages (boo#1200107)</changelog>
  <changelog author="mwilck@suse.com" date="1674648000">- Update to version 15.5.0:
  * version adapted, code is identical to 15.4.15</changelog>
  <changelog author="mwilck@suse.com" date="1675339200">- Update to version 15.5.1:
  * modprobe.conf: s390x: remove softdep on fbcon (boo#1207853)</changelog>
  <changelog author="mwilck@suse.com" date="1693569600">- Update to version 15.5.2:
  * rpm-script: update bootloader after creating initramfs
    (boo#1213822)
  * rpm-script: check for regenerate-initrd-posttrans in %posttrans
    (boo#1212957)
  * cert-script: skip cert handling if efivarfs is not writable
    (bsc#1213428, bsc#1201066)</changelog>
  <changelog author="mwilck@suse.com" date="1697198400">- Update to version 15.5.3:
  * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559)
  * modprobe.d: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829)
    (note: this is not a full fix for that CVE)</changelog>
</package>
<package pkgid="5b87e32a070655091ac0a2c147f66bdadac33cbc0fc56d7602b9277197570de5" name="suse-module-tools" arch="s390x">
  <version epoch="0" ver="15.5.3" rel="150500.3.6.1"/>
  <changelog author="mwilck@suse.com" date="1623931200">- Update to version 15.3.7:
  * Fix treatment of compressed modules (bsc#1187093)</changelog>
  <changelog author="mwilck@suse.com" date="1625572800">- Update to version 15.3.8:
  * modprobe.d: Remove dma=none setting for parport_pc
    (bsc#1177695)</changelog>
  <changelog author="mwilck@suse.com" date="1628856000">- Update to version 15.4.2
- Move config files to /lib/modprobe.d and /lib/depmod.d
  (jsc#SLE-20639)
  * "modprobe $FS" for a blacklisted file system now offers to
    unblacklist the module permanently
  * disabled automatic un-blacklisting of filesystem modules loaded
    at installation time
- Replace mkinitrd with dracut everywhere (jsc#SLE-20348)
- Add faster substitute for lsinitrd to speed up weak-modules2
  (jsc#SLE-9078)
- Enable f2fs
- Add a "Supplements" dependency on dkms to the "legacy" submodule
  (dkms needs "weak-modules")
- modprobe.d cleanups and fixes:
  * Unify ppc64 and ppc64le
  * Delete files for obsolete architectures
  * Remove obsolete SUSE_INITRD statements (bsc#1161343)
  * Remove dma=none setting for parport_pc (bsc#1177695)
- Add README.md</changelog>
  <changelog author="mwilck@suse.com" date="1629374400">- Update to version 15.4.3:
  * fix problem that initrd may not be rebuilt after installing
    kernel-$flavor-extra (bsc#1189441)</changelog>
  <changelog author="mwilck@suse.com" date="1633089600">- Update to version 15.4.4:
  * Import kernel scriptlets from kernel-source
    (bsc#1189841, bsc#1190598)
  * Provide "suse-kernel-rpm-scriptlets"</changelog>
  <changelog author="mwilck@suse.com" date="1633348800">- Update to version 15.4.5:
  * inkmp-script(postun): don't pass  existing files to weak-modules2
    (boo#1191200)
  * kernel-scriptlets: skip cert scriptlet on non-UEFI systems
    (boo#1191260)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 15.4.6:
  * rpm-script: fix bad exit status in OpenQA (bsc#1191922)
  * cert-script: Deal with existing $cert.delete file (bsc#1191804).
  * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480).
  * cert-script: Only print mokutil output in verbose mode.</changelog>
  <changelog author="mwilck@suse.com" date="1634904001">- Update to version 15.4.7:
  * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)"</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Update to version 15.4.8:
  * Same as Factory version 16.0.14
  * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE).
    Both packages are now both obsoleted by suse-module-tools.
    (jsc#SLE-21032)
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="mwilck@suse.com" date="1639396800">- Update to version 15.4.9:
  * same as Factory version 16.0.16
  * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059)
  - Rather than shipping two large files with modprobe.d options
    (00-system.conf and 50-blacklist.conf), ship multiple small
    per-module files. This makes it easier for users to override
    distribution defaults.
  * blacklist isst_if_mbox_msr (bsc#1187196)
  * boot-sysctl: make sure file exists (fix for containers)
  * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718)</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">- Update to version 15.4.10:
  * same as Factory version 16.0.17
  * 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)
  * install some modprobe.d files only for relevant architectures
    (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974)</changelog>
  <changelog author="mwilck@suse.com" date="1641297600">- Update to version 15.4.11:
  * cdrom: Disable autoclose by default (boo#1165047).
  * Make regenerate-initrd-posttrans compatible with Dracut's
    UEFI mode (unified kernel image)</changelog>
  <changelog author="mwilck@suse.com" date="1643371200">- Update to version 15.4.12:
  * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051)
  * rpm-script: force-copy kernel to /boot (boo#1194501)</changelog>
  <changelog author="mwilck@suse.com" date="1667563200">- Update to version 15.4.13:
  * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- Update to version 15.4.14:
  * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423)</changelog>
  <changelog author="mwilck@suse.com" date="1669032001">- Update to version 15.4.15: Backport bug fixes from factory
  * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092)
  * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391)
  * driver-check.sh: avoid false positive error messages (boo#1200107)</changelog>
  <changelog author="mwilck@suse.com" date="1674648000">- Update to version 15.5.0:
  * version adapted, code is identical to 15.4.15</changelog>
  <changelog author="mwilck@suse.com" date="1675339200">- Update to version 15.5.1:
  * modprobe.conf: s390x: remove softdep on fbcon (boo#1207853)</changelog>
  <changelog author="mwilck@suse.com" date="1693569600">- Update to version 15.5.2:
  * rpm-script: update bootloader after creating initramfs
    (boo#1213822)
  * rpm-script: check for regenerate-initrd-posttrans in %posttrans
    (boo#1212957)
  * cert-script: skip cert handling if efivarfs is not writable
    (bsc#1213428, bsc#1201066)</changelog>
  <changelog author="mwilck@suse.com" date="1697198400">- Update to version 15.5.3:
  * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559)
  * modprobe.d: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829)
    (note: this is not a full fix for that CVE)</changelog>
</package>
<package pkgid="6fa309befb38a8be2f097c649169ec3e6469428b670620eeee5bce79d8d43b17" name="suse-module-tools" arch="src">
  <version epoch="0" ver="15.5.3" rel="150500.3.6.1"/>
  <changelog author="mwilck@suse.com" date="1623931200">- Update to version 15.3.7:
  * Fix treatment of compressed modules (bsc#1187093)</changelog>
  <changelog author="mwilck@suse.com" date="1625572800">- Update to version 15.3.8:
  * modprobe.d: Remove dma=none setting for parport_pc
    (bsc#1177695)</changelog>
  <changelog author="mwilck@suse.com" date="1628856000">- Update to version 15.4.2
- Move config files to /lib/modprobe.d and /lib/depmod.d
  (jsc#SLE-20639)
  * "modprobe $FS" for a blacklisted file system now offers to
    unblacklist the module permanently
  * disabled automatic un-blacklisting of filesystem modules loaded
    at installation time
- Replace mkinitrd with dracut everywhere (jsc#SLE-20348)
- Add faster substitute for lsinitrd to speed up weak-modules2
  (jsc#SLE-9078)
- Enable f2fs
- Add a "Supplements" dependency on dkms to the "legacy" submodule
  (dkms needs "weak-modules")
- modprobe.d cleanups and fixes:
  * Unify ppc64 and ppc64le
  * Delete files for obsolete architectures
  * Remove obsolete SUSE_INITRD statements (bsc#1161343)
  * Remove dma=none setting for parport_pc (bsc#1177695)
- Add README.md</changelog>
  <changelog author="mwilck@suse.com" date="1629374400">- Update to version 15.4.3:
  * fix problem that initrd may not be rebuilt after installing
    kernel-$flavor-extra (bsc#1189441)</changelog>
  <changelog author="mwilck@suse.com" date="1633089600">- Update to version 15.4.4:
  * Import kernel scriptlets from kernel-source
    (bsc#1189841, bsc#1190598)
  * Provide "suse-kernel-rpm-scriptlets"</changelog>
  <changelog author="mwilck@suse.com" date="1633348800">- Update to version 15.4.5:
  * inkmp-script(postun): don't pass  existing files to weak-modules2
    (boo#1191200)
  * kernel-scriptlets: skip cert scriptlet on non-UEFI systems
    (boo#1191260)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 15.4.6:
  * rpm-script: fix bad exit status in OpenQA (bsc#1191922)
  * cert-script: Deal with existing $cert.delete file (bsc#1191804).
  * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480).
  * cert-script: Only print mokutil output in verbose mode.</changelog>
  <changelog author="mwilck@suse.com" date="1634904001">- Update to version 15.4.7:
  * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)"</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Update to version 15.4.8:
  * Same as Factory version 16.0.14
  * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE).
    Both packages are now both obsoleted by suse-module-tools.
    (jsc#SLE-21032)
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="mwilck@suse.com" date="1639396800">- Update to version 15.4.9:
  * same as Factory version 16.0.16
  * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059)
  - Rather than shipping two large files with modprobe.d options
    (00-system.conf and 50-blacklist.conf), ship multiple small
    per-module files. This makes it easier for users to override
    distribution defaults.
  * blacklist isst_if_mbox_msr (bsc#1187196)
  * boot-sysctl: make sure file exists (fix for containers)
  * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718)</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">- Update to version 15.4.10:
  * same as Factory version 16.0.17
  * 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)
  * install some modprobe.d files only for relevant architectures
    (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974)</changelog>
  <changelog author="mwilck@suse.com" date="1641297600">- Update to version 15.4.11:
  * cdrom: Disable autoclose by default (boo#1165047).
  * Make regenerate-initrd-posttrans compatible with Dracut's
    UEFI mode (unified kernel image)</changelog>
  <changelog author="mwilck@suse.com" date="1643371200">- Update to version 15.4.12:
  * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051)
  * rpm-script: force-copy kernel to /boot (boo#1194501)</changelog>
  <changelog author="mwilck@suse.com" date="1667563200">- Update to version 15.4.13:
  * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- Update to version 15.4.14:
  * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423)</changelog>
  <changelog author="mwilck@suse.com" date="1669032001">- Update to version 15.4.15: Backport bug fixes from factory
  * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092)
  * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391)
  * driver-check.sh: avoid false positive error messages (boo#1200107)</changelog>
  <changelog author="mwilck@suse.com" date="1674648000">- Update to version 15.5.0:
  * version adapted, code is identical to 15.4.15</changelog>
  <changelog author="mwilck@suse.com" date="1675339200">- Update to version 15.5.1:
  * modprobe.conf: s390x: remove softdep on fbcon (boo#1207853)</changelog>
  <changelog author="mwilck@suse.com" date="1693569600">- Update to version 15.5.2:
  * rpm-script: update bootloader after creating initramfs
    (boo#1213822)
  * rpm-script: check for regenerate-initrd-posttrans in %posttrans
    (boo#1212957)
  * cert-script: skip cert handling if efivarfs is not writable
    (bsc#1213428, bsc#1201066)</changelog>
  <changelog author="mwilck@suse.com" date="1697198400">- Update to version 15.5.3:
  * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559)
  * modprobe.d: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829)
    (note: this is not a full fix for that CVE)</changelog>
</package>
<package pkgid="a7e691ae30877a7242b83b040ff2baed813994f5bcc7e21025769d8e7756b665" name="suse-module-tools" arch="x86_64">
  <version epoch="0" ver="15.5.3" rel="150500.3.6.1"/>
  <changelog author="mwilck@suse.com" date="1623931200">- Update to version 15.3.7:
  * Fix treatment of compressed modules (bsc#1187093)</changelog>
  <changelog author="mwilck@suse.com" date="1625572800">- Update to version 15.3.8:
  * modprobe.d: Remove dma=none setting for parport_pc
    (bsc#1177695)</changelog>
  <changelog author="mwilck@suse.com" date="1628856000">- Update to version 15.4.2
- Move config files to /lib/modprobe.d and /lib/depmod.d
  (jsc#SLE-20639)
  * "modprobe $FS" for a blacklisted file system now offers to
    unblacklist the module permanently
  * disabled automatic un-blacklisting of filesystem modules loaded
    at installation time
- Replace mkinitrd with dracut everywhere (jsc#SLE-20348)
- Add faster substitute for lsinitrd to speed up weak-modules2
  (jsc#SLE-9078)
- Enable f2fs
- Add a "Supplements" dependency on dkms to the "legacy" submodule
  (dkms needs "weak-modules")
- modprobe.d cleanups and fixes:
  * Unify ppc64 and ppc64le
  * Delete files for obsolete architectures
  * Remove obsolete SUSE_INITRD statements (bsc#1161343)
  * Remove dma=none setting for parport_pc (bsc#1177695)
- Add README.md</changelog>
  <changelog author="mwilck@suse.com" date="1629374400">- Update to version 15.4.3:
  * fix problem that initrd may not be rebuilt after installing
    kernel-$flavor-extra (bsc#1189441)</changelog>
  <changelog author="mwilck@suse.com" date="1633089600">- Update to version 15.4.4:
  * Import kernel scriptlets from kernel-source
    (bsc#1189841, bsc#1190598)
  * Provide "suse-kernel-rpm-scriptlets"</changelog>
  <changelog author="mwilck@suse.com" date="1633348800">- Update to version 15.4.5:
  * inkmp-script(postun): don't pass  existing files to weak-modules2
    (boo#1191200)
  * kernel-scriptlets: skip cert scriptlet on non-UEFI systems
    (boo#1191260)</changelog>
  <changelog author="mwilck@suse.com" date="1634904000">- Update to version 15.4.6:
  * rpm-script: fix bad exit status in OpenQA (bsc#1191922)
  * cert-script: Deal with existing $cert.delete file (bsc#1191804).
  * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480).
  * cert-script: Only print mokutil output in verbose mode.</changelog>
  <changelog author="mwilck@suse.com" date="1634904001">- Update to version 15.4.7:
  * fixup "rpm-script: fix bad exit status in OpenQA (bsc#1191922)"</changelog>
  <changelog author="mwilck@suse.com" date="1636459200">- Update to version 15.4.8:
  * Same as Factory version 16.0.14
  * add udev rules from udev-extra-rules (formerly system-tuning-common-SUSE).
    Both packages are now both obsoleted by suse-module-tools.
    (jsc#SLE-21032)
  * 60-io-scheduler.rules: don't use BFQ for real multiqueue devices
    (jsc#SLE-21032, bsc#1192161)
  * 60-io-scheduler.rules: use "none" for multipath components
    (bsc#1192161)</changelog>
  <changelog author="mwilck@suse.com" date="1639396800">- Update to version 15.4.9:
  * same as Factory version 16.0.16
  * modprobe.d: split conf files (jsc#SLE-21626, boo#1193059)
  - Rather than shipping two large files with modprobe.d options
    (00-system.conf and 50-blacklist.conf), ship multiple small
    per-module files. This makes it easier for users to override
    distribution defaults.
  * blacklist isst_if_mbox_msr (bsc#1187196)
  * boot-sysctl: make sure file exists (fix for containers)
  * remove blacklist entry for snd_bt87x (bsc#1192974, bsc#51718)</changelog>
  <changelog author="mwilck@suse.com" date="1640001600">- Update to version 15.4.10:
  * same as Factory version 16.0.17
  * 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "none" for loop devices
    (boo#1193759)
  * install some modprobe.d files only for relevant architectures
    (apm_bios, sonypi, toshiba, legacy rtc) (bsc#1192974)</changelog>
  <changelog author="mwilck@suse.com" date="1641297600">- Update to version 15.4.11:
  * cdrom: Disable autoclose by default (boo#1165047).
  * Make regenerate-initrd-posttrans compatible with Dracut's
    UEFI mode (unified kernel image)</changelog>
  <changelog author="mwilck@suse.com" date="1643371200">- Update to version 15.4.12:
  * Add /etc/modprobe.d/README on SLE/Leap (bsc#1195051)
  * rpm-script: force-copy kernel to /boot (boo#1194501)</changelog>
  <changelog author="mwilck@suse.com" date="1667563200">- Update to version 15.4.13:
  * 80-hotplug-cpu-mem.rules: restrict cpu rule to x86_64 (bsc#1204423)</changelog>
  <changelog author="mwilck@suse.com" date="1669032000">- Update to version 15.4.14:
  * 80-hotplug-cpu-mem.rules: use CONST{arch} (bsc#1204423)</changelog>
  <changelog author="mwilck@suse.com" date="1669032001">- Update to version 15.4.15: Backport bug fixes from factory
  * driver-check.sh, unblacklist: convert egrep to grep -E (bsc#1203092)
  * kernel-scriptlets: don't pass flags to weak-modules2 (bsc#1195391)
  * driver-check.sh: avoid false positive error messages (boo#1200107)</changelog>
  <changelog author="mwilck@suse.com" date="1674648000">- Update to version 15.5.0:
  * version adapted, code is identical to 15.4.15</changelog>
  <changelog author="mwilck@suse.com" date="1675339200">- Update to version 15.5.1:
  * modprobe.conf: s390x: remove softdep on fbcon (boo#1207853)</changelog>
  <changelog author="mwilck@suse.com" date="1693569600">- Update to version 15.5.2:
  * rpm-script: update bootloader after creating initramfs
    (boo#1213822)
  * rpm-script: check for regenerate-initrd-posttrans in %posttrans
    (boo#1212957)
  * cert-script: skip cert handling if efivarfs is not writable
    (bsc#1213428, bsc#1201066)</changelog>
  <changelog author="mwilck@suse.com" date="1697198400">- Update to version 15.5.3:
  * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559)
  * modprobe.d: Blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829)
    (note: this is not a full fix for that CVE)</changelog>
</package>
<package pkgid="136acb22080435e3f66f71c2ff1469ca7e5894e15ccea505407641bd97170c52" name="systemd" arch="aarch64">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="260b4f5eb800d15a00e2c1355043cfe933bcf77b51f9e72ca096586ac765871e" name="systemd" arch="s390x">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="ec7fb0719011cb2b2da827a0f4cc250c6026d3c8f42d9813a38a0e27dc7f94ad" name="systemd" arch="src">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="80c5f10ad44463b9483c6baec12503809be4ce375c49094560dce7d144a727b7" name="systemd" arch="x86_64">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="8f79b83306db115eec028f97d5fd6331c7d8753377acfe8aaff8af3965f2ded4" name="systemd-container" arch="aarch64">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="e56d6443b91acef0b1f7ad76b93655e296b74e30fd853ca964a563f5306ad70c" name="systemd-container" arch="s390x">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="26521b53c081a17d54d9f912672db1710cfa33b290ada613d291e7ce6f563642" name="systemd-container" arch="x86_64">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="c2e07724a3df9e9e5bb094252ffd44fe80b20190098dbcde9762493e090f39c2" name="systemd-journal-remote" arch="aarch64">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="c9e54c513053635de495a56b6713d4dbddd435dbc573a318cacc9a0d22eb9d3b" name="systemd-journal-remote" arch="s390x">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="5c3d03e1f108d58083609007d1977cb09385037521c9dd202ddc67910e916af7" name="systemd-journal-remote" arch="x86_64">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="2fa549363af56f6651d883cf4c83dcbcb71161bbdb8cfdb0e6affab310a18730" name="systemd-rpm-macros" arch="noarch">
  <version epoch="0" ver="14" rel="150000.7.36.1"/>
  <changelog author="alarrosa@suse.com" date="1614945600">- Add a %systemd_user_pre macro (boo#1183051, boo#1183012)
  It creates a /run/systemd/rpm/needs-user-preset/$service file for
  each new service being installed so %systemd_user_post can call
  `systemctl --global preset $service` properly for newly installed
  user services (even when it's introduced via a package update).</changelog>
  <changelog author="fbui@suse.com" date="1614945601">- Don't pass -f to rm to make sure that rm failures will be logged
  But also make sure to not abort the scriptlet prematurely if rm
  fails.</changelog>
  <changelog author="fbui@suse.com" date="1614945602">- Remove confusing --user before --global in %systemd_user_preun
  It's actually a backport of upstream commit
  28d36da64a7a23a55e8d0a139f2620384fd058b3
- Update a few comments</changelog>
  <changelog author="fbui@suse.com" date="1614945603">- Bump to version 7</changelog>
  <changelog author="fbui@suse.com" date="1621944000">- %sysusers_create_inline: use here-docs instead of echo (bsc#1186282)
  Upstream commit dd2490ae12ad1e1795ecbf8f8944b950da9c8d06.</changelog>
  <changelog author="fbui@suse.com" date="1626436800">- Introduce %sysusers_create_package
  %sysusers_create and %sysusers_create_inline are now deprecated and
  the new macro should be used instead.
  Upstream commit 07a7d4a0040d221ff09e527e91c112b4ffab1dba.</changelog>
  <changelog author="fbui@suse.com" date="1626436801">- Make use of "Suggests:" in %systemd_ordering
  Until libzypp supports "OrderWithRequires:", we need to specify a
  similar ordering constraint that can be understood by the dep solver
  as well. Hence the use of "Suggests:" in %systemd_ordering
  (workaround for bsc#1187332).</changelog>
  <changelog author="fbui@suse.com" date="1626436802">- Bump to version 8</changelog>
  <changelog author="fbui@suse.com" date="1637150400">- Introduce %_systemd_util_dir
  It's a backport of upstream commit 3bc66bfa0136e370a8f7b06c3b69a52f5636ef82.</changelog>
  <changelog author="fbui@suse.com" date="1637150401">- Bump version to 9</changelog>
  <changelog author="fbui@suse.com" date="1642593600">- %sysusers_create_inline was wrongly marked as deprecated
- %sysusers_create can be useful in certain cases and won't go away until we'll
  move to file triggers. So don't mark it as deprecated too</changelog>
  <changelog author="fbui@suse.com" date="1642593601">- Bump version to 10</changelog>
  <changelog author="fbui@suse.com" date="1646308800">- Make %_modprobedir point to /lib/modprobe.d (bsc#1196275 bsc#1196406)
  Until SLE15-SP3:QU2, /usr/lib/modprobe.d path was not supported by kmod and
  since SLE15-SP4 /etc/modprobe.d/README has references to /lib/modprobe.d...</changelog>
  <changelog author="fbui@suse.com" date="1646308801">- Bump version to 11</changelog>
  <changelog author="fbui@suse.com" date="1676548800">- Don't emit a warning when the flag file in /var/lib/systemd/migrated/ is not
  present as it's expected (bsc#1208079).</changelog>
  <changelog author="fbui@suse.com" date="1676548801">- Bump version to 12</changelog>
  <changelog author="fbui@suse.com" date="1683720000">- Fix %sysctl_apply() and %binfmt_apply() so they are disabled when called from
  a chroot (bsc#1211272)</changelog>
  <changelog author="fbui@suse.com" date="1683720001">- Bump version to 13</changelog>
  <changelog author="fbui@suse.com" date="1695988800">- Switch to `systemd-hwdb` tool when updating the HW database. It's been
  introduced in systemd v219 and replaces the deprecated command `udevadm hwdb`.</changelog>
  <changelog author="fbui@suse.com" date="1695988801">- Bump version to 14</changelog>
</package>
<package pkgid="17f9353c0df32c86581e2196d20955974dea5e1d5cdb7beb1e385ee2abbc926a" name="systemd-rpm-macros" arch="src">
  <version epoch="0" ver="14" rel="150000.7.36.1"/>
  <changelog author="alarrosa@suse.com" date="1614945600">- Add a %systemd_user_pre macro (boo#1183051, boo#1183012)
  It creates a /run/systemd/rpm/needs-user-preset/$service file for
  each new service being installed so %systemd_user_post can call
  `systemctl --global preset $service` properly for newly installed
  user services (even when it's introduced via a package update).</changelog>
  <changelog author="fbui@suse.com" date="1614945601">- Don't pass -f to rm to make sure that rm failures will be logged
  But also make sure to not abort the scriptlet prematurely if rm
  fails.</changelog>
  <changelog author="fbui@suse.com" date="1614945602">- Remove confusing --user before --global in %systemd_user_preun
  It's actually a backport of upstream commit
  28d36da64a7a23a55e8d0a139f2620384fd058b3
- Update a few comments</changelog>
  <changelog author="fbui@suse.com" date="1614945603">- Bump to version 7</changelog>
  <changelog author="fbui@suse.com" date="1621944000">- %sysusers_create_inline: use here-docs instead of echo (bsc#1186282)
  Upstream commit dd2490ae12ad1e1795ecbf8f8944b950da9c8d06.</changelog>
  <changelog author="fbui@suse.com" date="1626436800">- Introduce %sysusers_create_package
  %sysusers_create and %sysusers_create_inline are now deprecated and
  the new macro should be used instead.
  Upstream commit 07a7d4a0040d221ff09e527e91c112b4ffab1dba.</changelog>
  <changelog author="fbui@suse.com" date="1626436801">- Make use of "Suggests:" in %systemd_ordering
  Until libzypp supports "OrderWithRequires:", we need to specify a
  similar ordering constraint that can be understood by the dep solver
  as well. Hence the use of "Suggests:" in %systemd_ordering
  (workaround for bsc#1187332).</changelog>
  <changelog author="fbui@suse.com" date="1626436802">- Bump to version 8</changelog>
  <changelog author="fbui@suse.com" date="1637150400">- Introduce %_systemd_util_dir
  It's a backport of upstream commit 3bc66bfa0136e370a8f7b06c3b69a52f5636ef82.</changelog>
  <changelog author="fbui@suse.com" date="1637150401">- Bump version to 9</changelog>
  <changelog author="fbui@suse.com" date="1642593600">- %sysusers_create_inline was wrongly marked as deprecated
- %sysusers_create can be useful in certain cases and won't go away until we'll
  move to file triggers. So don't mark it as deprecated too</changelog>
  <changelog author="fbui@suse.com" date="1642593601">- Bump version to 10</changelog>
  <changelog author="fbui@suse.com" date="1646308800">- Make %_modprobedir point to /lib/modprobe.d (bsc#1196275 bsc#1196406)
  Until SLE15-SP3:QU2, /usr/lib/modprobe.d path was not supported by kmod and
  since SLE15-SP4 /etc/modprobe.d/README has references to /lib/modprobe.d...</changelog>
  <changelog author="fbui@suse.com" date="1646308801">- Bump version to 11</changelog>
  <changelog author="fbui@suse.com" date="1676548800">- Don't emit a warning when the flag file in /var/lib/systemd/migrated/ is not
  present as it's expected (bsc#1208079).</changelog>
  <changelog author="fbui@suse.com" date="1676548801">- Bump version to 12</changelog>
  <changelog author="fbui@suse.com" date="1683720000">- Fix %sysctl_apply() and %binfmt_apply() so they are disabled when called from
  a chroot (bsc#1211272)</changelog>
  <changelog author="fbui@suse.com" date="1683720001">- Bump version to 13</changelog>
  <changelog author="fbui@suse.com" date="1695988800">- Switch to `systemd-hwdb` tool when updating the HW database. It's been
  introduced in systemd v219 and replaces the deprecated command `udevadm hwdb`.</changelog>
  <changelog author="fbui@suse.com" date="1695988801">- Bump version to 14</changelog>
</package>
<package pkgid="02fa858628d596c9c1f2ff1145367a3090460f24cf9fc992d824aa19a2392d2f" name="systemd-sysvinit" arch="aarch64">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="10ad3de75b55d509cfa7186470dd867c14278a20a6085e86ea43994fc51577ca" name="systemd-sysvinit" arch="s390x">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="f723506ecd6cf622bfd8dad31cca3c45945f828470e2549663ffd1d79609e15a" name="systemd-sysvinit" arch="x86_64">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="b5322d0de7a71bb4baff8799c4f09db9f8ad3d1849b7b6f39e5817209f963733" name="typelib-1_0-HarfBuzz-0_0" arch="aarch64">
  <version epoch="0" ver="3.4.0" rel="150400.3.8.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1591185600">- Update to version 2.6.7:
  + Update to Unicode 13.0.0
  + Fix hb_ot_layout_get_ligature_carets for fonts without lcar
    table
- includes fixes from 2.6.6:
  * A fix in AAT kerning for Geeza Pro</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1592913600">- update to 2.6.8:
  + New API to fetch glyph alternates from GSUB table
  + New API +hb_ot_layout_lookup_get_glyph_alternates()
- Drop gpg2 BuildRequires and stop verifying signature during
  build: upstream no longer signs the tarball/signature.</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- Update to version 2.7.2:
  + Fix a regression in the previous release that caused a crash
    with Kaithi.
  + More OOM fixes.
  + ot-funcs now handles variable empty glyphs better when
    hvar/vvar isn't present.
  + Reverted a GDEF processing regression.
  + A couple of fixes to handle OOM better.
  + Use an implementation for round that always rounds up, some
    minor fluctuations are expected on var font specially when
    hb-ot callback is used.
  + Fix an AAT's `kerx` issue on broken rendering of Devanagari
    Sangam MN.
  + Remove AAT's `lcar` table support from _get_ligature_carets
    API, not even much use on macOS installed fonts (only two
    files). GDEF support is the recommended one and expected to
    work properly after issues fixed two releases ago.
  - Minor memory fixes to handle OOM better specially in hb-ft.
  - Minor .so files versioning scheme change and remove
    stable/unstable scheme differences, was never used in practice
    (always default to stable scheme).
  - We are now suggesting careful packaging of the library using
    meson, https://github.com/harfbuzz/harfbuzz/wiki/Notes-on-migration-to-meson
    for more information.
  - Distribution package URL is changed, either use GitHub
    generated tarballs,
    `https://github.com/harfbuzz/harfbuzz/archive/$pkgver.tar.gz`
    or, even more preferably use commit hash of the release and git
    checkouts like,
    `git+https://github.com/harfbuzz/harfbuzz#commit=$commit`</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1609070400">- Update to version 2.7.4:
  + Fix missing --enable-introspection configure option
- Changes from version 2.7.3:
  + Update USE shaper to 2020-08-13 specification, and other
    improvements
  + Don’t disable liga feature in myanmar shaper, to match
    Uniscribe
  + Improvements to language and script tags handling.
  + Update language system tag registry to OpenType 1.8.4
  + Support for serializing and deserializing Unicode buffers
  + Increase buffer work limits to handle fonts with many complex
    lookups
  + Handle more shaping operations in trace output
  + Memory access fixes
  + More OOM fixes
  + Improved documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610107200">- Switch to meson buildsystem:
  + Add meson BuildRequires and macros.
  + Replace gcc-c++ for generic c++_compiler BuildRequires.
  + Add meson_test macro in check section, run tests during build.
  + Drop pkgconfig(graphite2) BuildRequires: No longer build
    graphite2 support, following upstream that disables this by
    default.
  + Stop packaging gtk-docs, pass -Ddocs=disabled to meson, this
    way we might avoid a build-cycle and since we did not have a
    explicit docs subpackage, just silently drop them.</changelog>
  <changelog author="dimstar@opensuse.org" date="1610539200">- Re-enable graphite2 support: TexLive relies on this to be
  present:
  + Pass -Dgraphite=enabled to meson.
  + Add pkgconfig(graphite2) BuildRequires.</changelog>
  <changelog author="christophe@krop.fr" date="1618315200">- Update to version 2.8.0:
  + Shape joining scripts other than Arabic/Syriac using the
    Universal Shaping Engine. Previously these were shaped using
    the generalized Arabic shaper.
  + Fix regression in shaping of U+0B55 ORIYA SIGN OVERLINE.
  + Update language tags.
  + Variations: reduce error: do not round each interpolated delta.
  + Documentation improvements.
  + Subsetter improvements: subsets most, if not all, lookup types
    now.
  + Fuzzer-found fixes and other improvements when memory failures
    happen.
  + Removed most atomic implementations now that we have C++11
    atomic impl.
  + General codebase upkeep; using more C++11 features: constexpr
    constructors, etc.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1620302400">- Update to version 2.8.1:
  + Subsetter now fully supports GSUB/GPOS/GDEF tables (including
    variations); as such, layout tables are retained by subsetter
    by default
  + hb-view supports iTerm2 and kitty inline image protocols
    it can also use Chafa for terminal graphics if available
- Add  pkgconfig(chafa): new, optional depdency.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1626264000">- Update to version 2.8.2:
  + Shaping LTR digits for RTL scripts now makes the native
    direction of the digits LTR, applying shaping and positioning
    rules on the same glyph order as Uniscribe
  + Subsetting COLR v1 and CPAL tables is now supported
  + Various fixes and improvements to the subsetter
  + When applying morx table, mark glyph widths should not be zeroed
  + GPOS is preferred over kerx, if GSUB was applied
  + Regional_Indicator pairs are grouped together when clustering</changelog>
  <changelog author="dimstar@opensuse.org" date="1626523200">- Drop pkgconfig(chafa) BuildRequires for now: causes a cycle
  between chafa and harfbuzz, and disable it in meson</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1631448000">- harfbuzz 2.9.1:
  + Subsetter API close to stable
  + Various fuzzer-found bug fixes
  + hb_buffer_append() now handles the pre- and post-context which
    previously were left unchanged in the destination buffer
  + hb-view / hb-shape now accept following new arguments:
  - -unicodes: takes a list of hex numbers that represent Unicode
    codepoints.
  + Undeprecated API: hb_set_invert()
- includes changes from 2.9.0:
  + Support multiple variation axes with same tag, aka HOI
  + The coretext testing shaper now passes font variations to
    CoreText
  + hb-shape/hb-view does not break line at new lines unless text
    is read from file
  + hb-view and hb-subset has a --batch now, similar to hb-shape
  + The --batch mode now uses ; as argument separator instead of :
    used previously
  + The --batch in hb-shape does not expect 0th argument anymore.
    That is, the lines read are interpreted as argv[1:], instead
    of argv[0:].
  + The --batch option has been undocumented. We are ready to
    document it; send feedback if you find it useful
  + hb-subset got arguments revamps. Added much-requested
  - -gids-file, --glyphs, --glyphs-file, --unicodes-file,
    supporting ranges in --unicodes.
  + Various bug fixes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1631966400">- harfbuzz 3.0.0:
  + Unicode 14.0 support
  + hb-subset API and harfbuzz-subset ABI now declared stable
  + hb-style API is now stable</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636200000">- harfbuzz 3.1.0:
  * Better offset-overflow handling in the subsetter library
  * Improved Unicode 14 properties in the USE shaper, and various
    other USE shaper fixes
  * MATH and COLR v1 tables subsetting support, and various other
    subsetter fixes
  * Support for Pwo Karen / Ason Chin medial la. (Simon Cozens)
  * Apply GPOS positioning when substituting with morx table, if
    kerx is missing
  * Apply calt and clig features across syllable boundaries in
    Indic shaper
  * Meson option for enabling Graphite 2 has been renamed to
    graphite2
  * Build and documentation fixes
- add harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636459200">- Update to version 3.1.1:
  + Work around GCC cast-align error/warning on some platforms.
  + Documentation improvements.
- Drop patch fixed upstream:
  + harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1639742400">- Update to 3.1.2:
  + hb-shape / hb-view: revert treating text on the commandline as
    single paragraph (was introduced in 3.0.0); add new
  - -single-par to do that
  + Subsetter bug fixes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1639742401">- Update to 3.2.0:
  + Fixed shaping of Apple Color Emoji flags in right-to-left context
  + Fixed positioning of CFF fonts in HB_TINY profile
  + OpenType 1.9 language tags update
  + Add HB_NO_VERTICAL config option
  + Add HB_CONFIG_OVERRIDE_H for easier configuration
  + Improved packing of cmap, loca, and Ligature tables
  + Significantly improved overflow-resolution strategy in the repacker</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1644235200">- update to 3.3.2:
  + Revert splitting of pair positioning values introduced in 3.3.0
    as it proved problematic
- includes changes from 3.3.1:
  + Fix heap-use-after-free in harfbuzz-subset introduced in
    previous release
- includes changes from 3.3.0:
  + Improved documentation, code cleanup
  + The low 16-bits of face index will be used by hb_face_create()
    to select a face inside a font collection file format, while the
    high 16-bits will be used by hb_font_create() to load the named
    instance
  + Glyph positions and other font metrics now apply synthetic slant
    set by hb_font_set_synthetic_slant(), for improved positioning
    for synthetically slanted fonts
  + Fixed unintentional locale dependency in hb_variation_to_string()
    for decimal point representation
  + When applying pair positioning (kerning) the positioning value
    is split between the two sides of the pair for improved cursor
    positioning between such pairs
  + Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in
    conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing
    re-shaping during line breaking. Check the documentation for
    further details
  + Improved handling of macrolanguages when mapping BCP 47 codes
    to OpenType tags</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1644753600">- update to 3.4.0:
  + Perform sanity checks on shaping results is now part of
    “harfbuzz” library and can be enabled by setting the buffer
    flag HB_BUFFER_FLAG_VERIFY
  + Arabic Mark Transient Reordering Algorithm have been updated
    to revision 6
  + ISO 15924 code for mathematical notation, ‘Zmth’, now maps to
    the OpenType ‘math’ tag
  + It is now possible to get at once all math kerning values for a
    given glyph at a given corner
  + Fix locale_t portability issues on systems the typedef’s it to
    a void pointer</changelog>
  <changelog author="mgorse@suse.com" date="1658836800">- Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents
  (boo#1200900 CVE-2022-33068).</changelog>
  <changelog author="mgorse@suse.com" date="1680696000">- Add CVE-2023-25193.patch: limit how far we skip when looking
  back (bsc#1207922 CVE-2023-25193).</changelog>
</package>
<package pkgid="26189e68a97c58b9fb27de7db2b4cc5e52c75f012e69c60455f0ad9308a80f24" name="typelib-1_0-HarfBuzz-0_0" arch="s390x">
  <version epoch="0" ver="3.4.0" rel="150400.3.8.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1591185600">- Update to version 2.6.7:
  + Update to Unicode 13.0.0
  + Fix hb_ot_layout_get_ligature_carets for fonts without lcar
    table
- includes fixes from 2.6.6:
  * A fix in AAT kerning for Geeza Pro</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1592913600">- update to 2.6.8:
  + New API to fetch glyph alternates from GSUB table
  + New API +hb_ot_layout_lookup_get_glyph_alternates()
- Drop gpg2 BuildRequires and stop verifying signature during
  build: upstream no longer signs the tarball/signature.</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- Update to version 2.7.2:
  + Fix a regression in the previous release that caused a crash
    with Kaithi.
  + More OOM fixes.
  + ot-funcs now handles variable empty glyphs better when
    hvar/vvar isn't present.
  + Reverted a GDEF processing regression.
  + A couple of fixes to handle OOM better.
  + Use an implementation for round that always rounds up, some
    minor fluctuations are expected on var font specially when
    hb-ot callback is used.
  + Fix an AAT's `kerx` issue on broken rendering of Devanagari
    Sangam MN.
  + Remove AAT's `lcar` table support from _get_ligature_carets
    API, not even much use on macOS installed fonts (only two
    files). GDEF support is the recommended one and expected to
    work properly after issues fixed two releases ago.
  - Minor memory fixes to handle OOM better specially in hb-ft.
  - Minor .so files versioning scheme change and remove
    stable/unstable scheme differences, was never used in practice
    (always default to stable scheme).
  - We are now suggesting careful packaging of the library using
    meson, https://github.com/harfbuzz/harfbuzz/wiki/Notes-on-migration-to-meson
    for more information.
  - Distribution package URL is changed, either use GitHub
    generated tarballs,
    `https://github.com/harfbuzz/harfbuzz/archive/$pkgver.tar.gz`
    or, even more preferably use commit hash of the release and git
    checkouts like,
    `git+https://github.com/harfbuzz/harfbuzz#commit=$commit`</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1609070400">- Update to version 2.7.4:
  + Fix missing --enable-introspection configure option
- Changes from version 2.7.3:
  + Update USE shaper to 2020-08-13 specification, and other
    improvements
  + Don’t disable liga feature in myanmar shaper, to match
    Uniscribe
  + Improvements to language and script tags handling.
  + Update language system tag registry to OpenType 1.8.4
  + Support for serializing and deserializing Unicode buffers
  + Increase buffer work limits to handle fonts with many complex
    lookups
  + Handle more shaping operations in trace output
  + Memory access fixes
  + More OOM fixes
  + Improved documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610107200">- Switch to meson buildsystem:
  + Add meson BuildRequires and macros.
  + Replace gcc-c++ for generic c++_compiler BuildRequires.
  + Add meson_test macro in check section, run tests during build.
  + Drop pkgconfig(graphite2) BuildRequires: No longer build
    graphite2 support, following upstream that disables this by
    default.
  + Stop packaging gtk-docs, pass -Ddocs=disabled to meson, this
    way we might avoid a build-cycle and since we did not have a
    explicit docs subpackage, just silently drop them.</changelog>
  <changelog author="dimstar@opensuse.org" date="1610539200">- Re-enable graphite2 support: TexLive relies on this to be
  present:
  + Pass -Dgraphite=enabled to meson.
  + Add pkgconfig(graphite2) BuildRequires.</changelog>
  <changelog author="christophe@krop.fr" date="1618315200">- Update to version 2.8.0:
  + Shape joining scripts other than Arabic/Syriac using the
    Universal Shaping Engine. Previously these were shaped using
    the generalized Arabic shaper.
  + Fix regression in shaping of U+0B55 ORIYA SIGN OVERLINE.
  + Update language tags.
  + Variations: reduce error: do not round each interpolated delta.
  + Documentation improvements.
  + Subsetter improvements: subsets most, if not all, lookup types
    now.
  + Fuzzer-found fixes and other improvements when memory failures
    happen.
  + Removed most atomic implementations now that we have C++11
    atomic impl.
  + General codebase upkeep; using more C++11 features: constexpr
    constructors, etc.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1620302400">- Update to version 2.8.1:
  + Subsetter now fully supports GSUB/GPOS/GDEF tables (including
    variations); as such, layout tables are retained by subsetter
    by default
  + hb-view supports iTerm2 and kitty inline image protocols
    it can also use Chafa for terminal graphics if available
- Add  pkgconfig(chafa): new, optional depdency.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1626264000">- Update to version 2.8.2:
  + Shaping LTR digits for RTL scripts now makes the native
    direction of the digits LTR, applying shaping and positioning
    rules on the same glyph order as Uniscribe
  + Subsetting COLR v1 and CPAL tables is now supported
  + Various fixes and improvements to the subsetter
  + When applying morx table, mark glyph widths should not be zeroed
  + GPOS is preferred over kerx, if GSUB was applied
  + Regional_Indicator pairs are grouped together when clustering</changelog>
  <changelog author="dimstar@opensuse.org" date="1626523200">- Drop pkgconfig(chafa) BuildRequires for now: causes a cycle
  between chafa and harfbuzz, and disable it in meson</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1631448000">- harfbuzz 2.9.1:
  + Subsetter API close to stable
  + Various fuzzer-found bug fixes
  + hb_buffer_append() now handles the pre- and post-context which
    previously were left unchanged in the destination buffer
  + hb-view / hb-shape now accept following new arguments:
  - -unicodes: takes a list of hex numbers that represent Unicode
    codepoints.
  + Undeprecated API: hb_set_invert()
- includes changes from 2.9.0:
  + Support multiple variation axes with same tag, aka HOI
  + The coretext testing shaper now passes font variations to
    CoreText
  + hb-shape/hb-view does not break line at new lines unless text
    is read from file
  + hb-view and hb-subset has a --batch now, similar to hb-shape
  + The --batch mode now uses ; as argument separator instead of :
    used previously
  + The --batch in hb-shape does not expect 0th argument anymore.
    That is, the lines read are interpreted as argv[1:], instead
    of argv[0:].
  + The --batch option has been undocumented. We are ready to
    document it; send feedback if you find it useful
  + hb-subset got arguments revamps. Added much-requested
  - -gids-file, --glyphs, --glyphs-file, --unicodes-file,
    supporting ranges in --unicodes.
  + Various bug fixes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1631966400">- harfbuzz 3.0.0:
  + Unicode 14.0 support
  + hb-subset API and harfbuzz-subset ABI now declared stable
  + hb-style API is now stable</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636200000">- harfbuzz 3.1.0:
  * Better offset-overflow handling in the subsetter library
  * Improved Unicode 14 properties in the USE shaper, and various
    other USE shaper fixes
  * MATH and COLR v1 tables subsetting support, and various other
    subsetter fixes
  * Support for Pwo Karen / Ason Chin medial la. (Simon Cozens)
  * Apply GPOS positioning when substituting with morx table, if
    kerx is missing
  * Apply calt and clig features across syllable boundaries in
    Indic shaper
  * Meson option for enabling Graphite 2 has been renamed to
    graphite2
  * Build and documentation fixes
- add harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636459200">- Update to version 3.1.1:
  + Work around GCC cast-align error/warning on some platforms.
  + Documentation improvements.
- Drop patch fixed upstream:
  + harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1639742400">- Update to 3.1.2:
  + hb-shape / hb-view: revert treating text on the commandline as
    single paragraph (was introduced in 3.0.0); add new
  - -single-par to do that
  + Subsetter bug fixes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1639742401">- Update to 3.2.0:
  + Fixed shaping of Apple Color Emoji flags in right-to-left context
  + Fixed positioning of CFF fonts in HB_TINY profile
  + OpenType 1.9 language tags update
  + Add HB_NO_VERTICAL config option
  + Add HB_CONFIG_OVERRIDE_H for easier configuration
  + Improved packing of cmap, loca, and Ligature tables
  + Significantly improved overflow-resolution strategy in the repacker</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1644235200">- update to 3.3.2:
  + Revert splitting of pair positioning values introduced in 3.3.0
    as it proved problematic
- includes changes from 3.3.1:
  + Fix heap-use-after-free in harfbuzz-subset introduced in
    previous release
- includes changes from 3.3.0:
  + Improved documentation, code cleanup
  + The low 16-bits of face index will be used by hb_face_create()
    to select a face inside a font collection file format, while the
    high 16-bits will be used by hb_font_create() to load the named
    instance
  + Glyph positions and other font metrics now apply synthetic slant
    set by hb_font_set_synthetic_slant(), for improved positioning
    for synthetically slanted fonts
  + Fixed unintentional locale dependency in hb_variation_to_string()
    for decimal point representation
  + When applying pair positioning (kerning) the positioning value
    is split between the two sides of the pair for improved cursor
    positioning between such pairs
  + Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in
    conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing
    re-shaping during line breaking. Check the documentation for
    further details
  + Improved handling of macrolanguages when mapping BCP 47 codes
    to OpenType tags</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1644753600">- update to 3.4.0:
  + Perform sanity checks on shaping results is now part of
    “harfbuzz” library and can be enabled by setting the buffer
    flag HB_BUFFER_FLAG_VERIFY
  + Arabic Mark Transient Reordering Algorithm have been updated
    to revision 6
  + ISO 15924 code for mathematical notation, ‘Zmth’, now maps to
    the OpenType ‘math’ tag
  + It is now possible to get at once all math kerning values for a
    given glyph at a given corner
  + Fix locale_t portability issues on systems the typedef’s it to
    a void pointer</changelog>
  <changelog author="mgorse@suse.com" date="1658836800">- Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents
  (boo#1200900 CVE-2022-33068).</changelog>
  <changelog author="mgorse@suse.com" date="1680696000">- Add CVE-2023-25193.patch: limit how far we skip when looking
  back (bsc#1207922 CVE-2023-25193).</changelog>
</package>
<package pkgid="42a92064a109b0c455f4bc7403126d6cd262ddd343088e42ed49488597c73a17" name="typelib-1_0-HarfBuzz-0_0" arch="x86_64">
  <version epoch="0" ver="3.4.0" rel="150400.3.8.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1591185600">- Update to version 2.6.7:
  + Update to Unicode 13.0.0
  + Fix hb_ot_layout_get_ligature_carets for fonts without lcar
    table
- includes fixes from 2.6.6:
  * A fix in AAT kerning for Geeza Pro</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1592913600">- update to 2.6.8:
  + New API to fetch glyph alternates from GSUB table
  + New API +hb_ot_layout_lookup_get_glyph_alternates()
- Drop gpg2 BuildRequires and stop verifying signature during
  build: upstream no longer signs the tarball/signature.</changelog>
  <changelog author="dmueller@suse.com" date="1600344000">- Update to version 2.7.2:
  + Fix a regression in the previous release that caused a crash
    with Kaithi.
  + More OOM fixes.
  + ot-funcs now handles variable empty glyphs better when
    hvar/vvar isn't present.
  + Reverted a GDEF processing regression.
  + A couple of fixes to handle OOM better.
  + Use an implementation for round that always rounds up, some
    minor fluctuations are expected on var font specially when
    hb-ot callback is used.
  + Fix an AAT's `kerx` issue on broken rendering of Devanagari
    Sangam MN.
  + Remove AAT's `lcar` table support from _get_ligature_carets
    API, not even much use on macOS installed fonts (only two
    files). GDEF support is the recommended one and expected to
    work properly after issues fixed two releases ago.
  - Minor memory fixes to handle OOM better specially in hb-ft.
  - Minor .so files versioning scheme change and remove
    stable/unstable scheme differences, was never used in practice
    (always default to stable scheme).
  - We are now suggesting careful packaging of the library using
    meson, https://github.com/harfbuzz/harfbuzz/wiki/Notes-on-migration-to-meson
    for more information.
  - Distribution package URL is changed, either use GitHub
    generated tarballs,
    `https://github.com/harfbuzz/harfbuzz/archive/$pkgver.tar.gz`
    or, even more preferably use commit hash of the release and git
    checkouts like,
    `git+https://github.com/harfbuzz/harfbuzz#commit=$commit`</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1609070400">- Update to version 2.7.4:
  + Fix missing --enable-introspection configure option
- Changes from version 2.7.3:
  + Update USE shaper to 2020-08-13 specification, and other
    improvements
  + Don’t disable liga feature in myanmar shaper, to match
    Uniscribe
  + Improvements to language and script tags handling.
  + Update language system tag registry to OpenType 1.8.4
  + Support for serializing and deserializing Unicode buffers
  + Increase buffer work limits to handle fonts with many complex
    lookups
  + Handle more shaping operations in trace output
  + Memory access fixes
  + More OOM fixes
  + Improved documentation.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610107200">- Switch to meson buildsystem:
  + Add meson BuildRequires and macros.
  + Replace gcc-c++ for generic c++_compiler BuildRequires.
  + Add meson_test macro in check section, run tests during build.
  + Drop pkgconfig(graphite2) BuildRequires: No longer build
    graphite2 support, following upstream that disables this by
    default.
  + Stop packaging gtk-docs, pass -Ddocs=disabled to meson, this
    way we might avoid a build-cycle and since we did not have a
    explicit docs subpackage, just silently drop them.</changelog>
  <changelog author="dimstar@opensuse.org" date="1610539200">- Re-enable graphite2 support: TexLive relies on this to be
  present:
  + Pass -Dgraphite=enabled to meson.
  + Add pkgconfig(graphite2) BuildRequires.</changelog>
  <changelog author="christophe@krop.fr" date="1618315200">- Update to version 2.8.0:
  + Shape joining scripts other than Arabic/Syriac using the
    Universal Shaping Engine. Previously these were shaped using
    the generalized Arabic shaper.
  + Fix regression in shaping of U+0B55 ORIYA SIGN OVERLINE.
  + Update language tags.
  + Variations: reduce error: do not round each interpolated delta.
  + Documentation improvements.
  + Subsetter improvements: subsets most, if not all, lookup types
    now.
  + Fuzzer-found fixes and other improvements when memory failures
    happen.
  + Removed most atomic implementations now that we have C++11
    atomic impl.
  + General codebase upkeep; using more C++11 features: constexpr
    constructors, etc.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1620302400">- Update to version 2.8.1:
  + Subsetter now fully supports GSUB/GPOS/GDEF tables (including
    variations); as such, layout tables are retained by subsetter
    by default
  + hb-view supports iTerm2 and kitty inline image protocols
    it can also use Chafa for terminal graphics if available
- Add  pkgconfig(chafa): new, optional depdency.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1626264000">- Update to version 2.8.2:
  + Shaping LTR digits for RTL scripts now makes the native
    direction of the digits LTR, applying shaping and positioning
    rules on the same glyph order as Uniscribe
  + Subsetting COLR v1 and CPAL tables is now supported
  + Various fixes and improvements to the subsetter
  + When applying morx table, mark glyph widths should not be zeroed
  + GPOS is preferred over kerx, if GSUB was applied
  + Regional_Indicator pairs are grouped together when clustering</changelog>
  <changelog author="dimstar@opensuse.org" date="1626523200">- Drop pkgconfig(chafa) BuildRequires for now: causes a cycle
  between chafa and harfbuzz, and disable it in meson</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1631448000">- harfbuzz 2.9.1:
  + Subsetter API close to stable
  + Various fuzzer-found bug fixes
  + hb_buffer_append() now handles the pre- and post-context which
    previously were left unchanged in the destination buffer
  + hb-view / hb-shape now accept following new arguments:
  - -unicodes: takes a list of hex numbers that represent Unicode
    codepoints.
  + Undeprecated API: hb_set_invert()
- includes changes from 2.9.0:
  + Support multiple variation axes with same tag, aka HOI
  + The coretext testing shaper now passes font variations to
    CoreText
  + hb-shape/hb-view does not break line at new lines unless text
    is read from file
  + hb-view and hb-subset has a --batch now, similar to hb-shape
  + The --batch mode now uses ; as argument separator instead of :
    used previously
  + The --batch in hb-shape does not expect 0th argument anymore.
    That is, the lines read are interpreted as argv[1:], instead
    of argv[0:].
  + The --batch option has been undocumented. We are ready to
    document it; send feedback if you find it useful
  + hb-subset got arguments revamps. Added much-requested
  - -gids-file, --glyphs, --glyphs-file, --unicodes-file,
    supporting ranges in --unicodes.
  + Various bug fixes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1631966400">- harfbuzz 3.0.0:
  + Unicode 14.0 support
  + hb-subset API and harfbuzz-subset ABI now declared stable
  + hb-style API is now stable</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1636200000">- harfbuzz 3.1.0:
  * Better offset-overflow handling in the subsetter library
  * Improved Unicode 14 properties in the USE shaper, and various
    other USE shaper fixes
  * MATH and COLR v1 tables subsetting support, and various other
    subsetter fixes
  * Support for Pwo Karen / Ason Chin medial la. (Simon Cozens)
  * Apply GPOS positioning when substituting with morx table, if
    kerx is missing
  * Apply calt and clig features across syllable boundaries in
    Indic shaper
  * Meson option for enabling Graphite 2 has been renamed to
    graphite2
  * Build and documentation fixes
- add harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1636459200">- Update to version 3.1.1:
  + Work around GCC cast-align error/warning on some platforms.
  + Documentation improvements.
- Drop patch fixed upstream:
  + harfbuzz-3.1.0-work-around-GCC-cast-align-error-warning.patch</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1639742400">- Update to 3.1.2:
  + hb-shape / hb-view: revert treating text on the commandline as
    single paragraph (was introduced in 3.0.0); add new
  - -single-par to do that
  + Subsetter bug fixes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1639742401">- Update to 3.2.0:
  + Fixed shaping of Apple Color Emoji flags in right-to-left context
  + Fixed positioning of CFF fonts in HB_TINY profile
  + OpenType 1.9 language tags update
  + Add HB_NO_VERTICAL config option
  + Add HB_CONFIG_OVERRIDE_H for easier configuration
  + Improved packing of cmap, loca, and Ligature tables
  + Significantly improved overflow-resolution strategy in the repacker</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1644235200">- update to 3.3.2:
  + Revert splitting of pair positioning values introduced in 3.3.0
    as it proved problematic
- includes changes from 3.3.1:
  + Fix heap-use-after-free in harfbuzz-subset introduced in
    previous release
- includes changes from 3.3.0:
  + Improved documentation, code cleanup
  + The low 16-bits of face index will be used by hb_face_create()
    to select a face inside a font collection file format, while the
    high 16-bits will be used by hb_font_create() to load the named
    instance
  + Glyph positions and other font metrics now apply synthetic slant
    set by hb_font_set_synthetic_slant(), for improved positioning
    for synthetically slanted fonts
  + Fixed unintentional locale dependency in hb_variation_to_string()
    for decimal point representation
  + When applying pair positioning (kerning) the positioning value
    is split between the two sides of the pair for improved cursor
    positioning between such pairs
  + Introduced new HB_GLYPH_FLAG_UNSAFE_TO_CONCAT, to be used in
    conjunction with HB_GLYPH_FLAG_UNSAFE_TO_BREAK for optimizing
    re-shaping during line breaking. Check the documentation for
    further details
  + Improved handling of macrolanguages when mapping BCP 47 codes
    to OpenType tags</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1644753600">- update to 3.4.0:
  + Perform sanity checks on shaping results is now part of
    “harfbuzz” library and can be enabled by setting the buffer
    flag HB_BUFFER_FLAG_VERIFY
  + Arabic Mark Transient Reordering Algorithm have been updated
    to revision 6
  + ISO 15924 code for mathematical notation, ‘Zmth’, now maps to
    the OpenType ‘math’ tag
  + It is now possible to get at once all math kerning values for a
    given glyph at a given corner
  + Fix locale_t portability issues on systems the typedef’s it to
    a void pointer</changelog>
  <changelog author="mgorse@suse.com" date="1658836800">- Add harfbuzz-CVE-2022-33068.patch: sbix: limit glyph extents
  (boo#1200900 CVE-2022-33068).</changelog>
  <changelog author="mgorse@suse.com" date="1680696000">- Add CVE-2023-25193.patch: limit how far we skip when looking
  back (bsc#1207922 CVE-2023-25193).</changelog>
</package>
<package pkgid="4fb93ed927d4a7084eb9e6bcd03b2a2a81bdc961fdf63daaa24ac06d4ea5b5bc" name="udev" arch="aarch64">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="4805422e3895b1bbb80e950072d487e4998c3b4692b673ccd0225c5585323343" name="udev" arch="s390x">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="0237fd8c58a98503759aceaad33095f049c7b5bbbb3e8276d6ee9586be3fffa8" name="udev" arch="x86_64">
  <version epoch="0" ver="249.16" rel="150400.8.35.5"/>
  <changelog author="fbui@suse.com" date="1675771200">- Import commit 119740915155d473de087bd633ba62c1c3e47d36 (merge of v249.15)
  For a complete list of changes, visit:
  https://github.com/openSUSE/systemd/compare/1bfa716e7fb6d7169cece864e75dfe9e52914c99...119740915155d473de087bd633ba62c1c3e47d36</changelog>
  <changelog author="fbui@suse.com" date="1675771201">- Conditionalize the use of /lib/modprobe.d only on systems with split usr
  support enabled (i.e. SLE).</changelog>
  <changelog author="fbui@suse.com" date="1675771202">- Drop a workaround related to systemd-timesyncd that addressed a Factory issue.</changelog>
  <changelog author="fbui@suse.com" date="1676030400">- Move systemd-boot and all components managing (secure) UEFI boot into udev
  sub-package: they may deserve a dedicated sub-package in the future but for
  now move them to udev so they aren't installed in systemd based containers.</changelog>
  <changelog author="fbui@suse.com" date="1676635200">- Drop build requirement on libpci, it's not more needed since udev hwdb was
  introduced 11 years ago.</changelog>
  <changelog author="lidong.zhong@suse.com" date="1677585600">- Fix return non-zero value when disabling SysVinit service (bsc#1208432)</changelog>
  <changelog author="fbui@suse.com" date="1677585601">- Import commit dad0071f15341be2b24c2c9d073e62617e0b4673 (merge of v249.16)</changelog>
  <changelog author="fbui@suse.com" date="1679313600">- Update 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
  Since commit 38f3e20883ff658935aae5c9 (v248), the symlinks /dev/cdrw and
  /dev/dvdrw could have no longer been created. Futhermore the rule added by
  this patch dealing with /dev/cdrom was redundant with the upstream one</changelog>
  <changelog author="fbui@suse.com" date="1680782400">- Update 1001-udev-use-lock-when-selecting-the-highest-priority-de.patch (bsc#1203141)
  Optimize when hundred workers claim the same symlink with the same priority.</changelog>
  <changelog author="fbui@suse.com" date="1680782401">- Import commit 6441bb41141aaa8bfb63559917362748a3044c15
  165ca0d018 udev-rules: fix nvme symlink creation on namespace changes (bsc#1207410)</changelog>
  <changelog author="fbui@suse.com" date="1682424000">- Include pam_keyinit.so in our systemd-user PAM service (bsc#1209741)
  That way "systemd --user" instances get their own session keyring instead of
  the user default session keyring. For some reasons cifscreds refuses to work
  with the latter. That's what is expected for every PAM session anyway.</changelog>
  <changelog author="mvidner@suse.com" date="1682683200">- kbd-model-map.legacy: drop some entries no longer needed by YaST
  Related to bsc#1194609.</changelog>
  <changelog author="fbui@suse.com" date="1682683201">- kbd-model-map.legacy:: add 'ara' which should replace 'arabic' in the long
  term (bsc#1210702)</changelog>
  <changelog author="fbui@suse.com" date="1683633600">- Rather than having one script per fix, use a single script (or "fixlet") per
  (sub) package that contains all the fixups relative to a (sub) package. This
  has the advantage to limit the number of scripts but more importantly it will
  ease the sharing of the spec file between TW and SLE. We should also be able
  to compare the fixlets of two distros even if the spec files have diverged.
  Note that all the fixups are run just once now.</changelog>
  <changelog author="fbui@suse.com" date="1683633601">- Move the persistent net rule fix in udev fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1684324800">- Move more packaging fixups in the fixlet script.</changelog>
  <changelog author="fbui@suse.com" date="1687348800">- Make sure to pre-install the groups systemd and udev rely on. This is needed
  when the tmpfiles are run at package installation time (i.e. when
  file-triggers are disabled).</changelog>
  <changelog author="fbui@suse.com" date="1690459200">- Add 5001-sleep-don-t-init-sys-power-resume-if-resume-option-i.patch (bsc#1186606)</changelog>
  <changelog author="fbui@suse.com" date="1690804800">- Import commit 155fe1917157bdeecf7e28ef0ea9f62084f27f14
  3b8c671f90 detach-md: similar to the DM case, also don't try to detach MD device backing /usr/ (bsc#1211576)
  6da5d2d1fc shutdown: don't attempt to detach DM volume backing /usr/ (bsc#1211576)
  37178881c1 udev: decrease devlink priority for iso disks (bsc#1213185)
  02ede28319 shutdown: get only active md arrays. (bsc#1212434 bsc#1213575 bsc#1211576)
  412b8dbb32 umount: /usr/ should never be unmounted regardless of HAVE_SPLIT_USR or not (bsc#1211576)
  16f897570a units: remove the restart limit on the modprobe@.service
  e4e85b08bd tests: add test case for long unit names
  3f84b06f9d core: shorten long unit names that are based on paths and append path hash at the end (bsc#1208194)</changelog>
  <changelog author="fbui@suse.com" date="1692187200">- Import commit b473c02cc08e093e370034425671cbc001c6748e
  02caac7973 units/initrd-parse-etc.service: Conflict with emergency.target
  70b3bff9f8 sd-device-monitor: dynamically allocate receive buffer (bsc#1213873)
  e2e1fbba2b sd-device: change type of properties nulstr from uint8_t* to char*
  c9d3dd5954 udev: set description for device monitor
  3f07f44fde test: use sd_device_monitor_set_description()
  b304a1e1a2 sd-device-monitor: logs description for device monitor
  929d4066c5 sd-device-monitor: introduce sd_device_monitor_{set,get}_description()
  340e523048 sd-device-monitor: fix inversed condition
  02659c7b67 tree-wide: port various places over to new stat_inode_same() helper
  b35a4b042a stat-util: add helper stat_inode_same() for comparing stat's st_dev/st_ino in one
  d25219cbe3 libsystemd: ignore both EINTR and EAGAIN
  648a151313 errno-util: introduce ERRNO_IS_TRANSIENT()</changelog>
</package>
<package pkgid="6eaac692a150df354bf9d8e3f01b484f6569aa80692a39a83bf43d2e105ca01f" name="xen" arch="src">
  <version epoch="0" ver="4.17.2_06" rel="150500.3.12.1"/>
  <changelog author="carnold@suse.com" date="1677758400">- bsc#1208736 - GCC 13: xen package fails
  bunzip-gcc13.patch
  altp2m-gcc13.patch
- Drop gcc13-fixes.patch</changelog>
  <changelog author="carnold@suse.com" date="1678190400">- bsc#1209017 - VUL-0: CVE-2022-42332: xen: x86 shadow plus
  log-dirty mode use-after-free (XSA-427)
  xsa427.patch
- bsc#1209018 - VUL-0: CVE-2022-42333,CVE-2022-42334: xen: x86/HVM
  pinned cache attributes mis-handling (XSA-428)
  xsa428-1.patch
  xsa428-2.patch
- bsc#1209019 - VUL-0: CVE-2022-42331: xen: x86: speculative
  vulnerability in 32bit SYSCALL path (XSA-429)
  xsa429.patch</changelog>
  <changelog author="ohering@suse.de" date="1678968000">- bsc#1209245 - fix host-assisted kexec/kdump for HVM domUs
  libxl.fix-guest-kexec-skip-cpuid-policy.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1679572800">- Upstream bug fixes (bsc#1027519)
  63a03b73-VMX-VMExit-based-BusLock-detection.patch
  63a03ba6-VMX-INTR_SHADOW_NMI-helper.patch
  63a03bce-VMX-Notify-VMExit.patch
  63e53ac9-x86-CPUID-leaves-7-1-ecx-edx.patch
  63e53ac9-x86-disable-CET-SS-when-fractured-updates.patch
  63f4d045-x86-ucode-AMD-apply-early-on-all-threads.patch
  63fe06e0-x86-ucode-AMD-apply-late-on-all-threads.patch
  641041e8-VT-d-constrain-IGD-check.patch
  6419697d-AMD-IOMMU-no-XT-x2APIC-phys.patch
- Use "proper" upstream backports:
  640f3035-x86-altp2m-help-gcc13.patch
  64104238-bunzip-gcc13.patch
  64199e0c-x86-shadow-account-for-log-dirty-mode.patch
  64199e0d-x86-HVM-bound-number-of-pca-regions.patch
  64199e0e-x86-HVM-serialize-pca-list-manipulation.patch
  64199e0f-x86-spec-ctrl-defer-CR4_PV32_RESTORE-for-CSTAR.patch
- ... in place of:
  bunzip-gcc13.patch
  altp2m-gcc13.patch
  xsa427.patch
  xsa428-1.patch
  xsa428-2.patch
  xsa429.patch</changelog>
  <changelog author="carnold@suse.com" date="1680264000">- Not building the shim is correctly handled by --disable-pvshim
  Drop disable-building-pv-shim.patch</changelog>
  <changelog author="carnold@suse.com" date="1681214400">- bsc#1210315 - VUL-0: CVE-2022-42335: xen: x86 shadow paging
  arbitrary pointer dereference (XSA-430)
  xsa430.patch</changelog>
  <changelog author="carnold@suse.com" date="1682596800">- Update to Xen 4.17.1 bug fix release (bsc#1027519)
  xen-4.17.1-testing-src.tar.bz2
  * No upstream changelog found in sources or webpage
- Dropped patches contained in new tarball
  63a03b73-VMX-VMExit-based-BusLock-detection.patch
  63a03ba6-VMX-INTR_SHADOW_NMI-helper.patch
  63a03bce-VMX-Notify-VMExit.patch
  63a03e28-x86-high-freq-TSC-overflow.patch
  63c05478-VMX-calculate-model-specific-LBRs-once.patch
  63c05478-VMX-support-CPUs-without-model-specific-LBR.patch
  63d24e91-tools-xenstore-revert-simplify-loop-handling.patch
  63e53ac9-x86-CPUID-leaves-7-1-ecx-edx.patch
  63e53ac9-x86-disable-CET-SS-when-fractured-updates.patch
  63ebca9c-x86-spec-ctrl-Mitigate-Cross-Thread-Return-Address-Predictions.patch
  63f4d045-x86-ucode-AMD-apply-early-on-all-threads.patch
  63fe06e0-x86-ucode-AMD-apply-late-on-all-threads.patch
  640f3035-x86-altp2m-help-gcc13.patch
  641041e8-VT-d-constrain-IGD-check.patch
  64104238-bunzip-gcc13.patch
  6419697d-AMD-IOMMU-no-XT-x2APIC-phys.patch
  64199e0c-x86-shadow-account-for-log-dirty-mode.patch
  64199e0d-x86-HVM-bound-number-of-pca-regions.patch
  64199e0e-x86-HVM-serialize-pca-list-manipulation.patch
  64199e0f-x86-spec-ctrl-defer-CR4_PV32_RESTORE-for-CSTAR.patch
  libxl.fix-guest-kexec-skip-cpuid-policy.patch
  xsa430.patch</changelog>
  <changelog author="carnold@suse.com" date="1682683200">- bsc#1209237 - xen-syms doesn't contain debug-info
  643e3810-CONFIG_DEBUG_INFO-no-EXPERT.patch
  643e387f-xen-update-CONFIG_DEBUG_INFO-help-text.patch
  6447a8fd-x86-EFI-permit-crash-dump-analysis.patch</changelog>
  <changelog author="carnold@suse.com" date="1683201600">- bsc#1210570 - gcc-13 realloc use-after-free analysis error
  64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch</changelog>
  <changelog author="carnold@suse.com" date="1684756800">- bsc#1211433 - VUL-0: CVE-2022-42336: xen: Mishandling of guest
  SSBD selection on AMD hardware (XSA-431)
  64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1688644800">- Upstream bug fixes (bsc#1027519)
  645dec48-AMD-IOMMU-assert-boolean-enum.patch
  646b782b-PCI-pci_get_pdev-respect-segment.patch
  647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch
  648863fc-AMD-IOMMU-Invalidate-All-check.patch</changelog>
  <changelog author="carnold@suse.com" date="1690286400">- bsc#1213616 - VUL-0: CVE-2023-20593: xen: x86/AMD: Zenbleed
  (XSA-433)
  64bea1b2-x86-AMD-Zenbleed.patch</changelog>
  <changelog author="ohering@suse.de" date="1690545600">- Add more debug to libxc-sr-track-migration-time.patch
  This is supposed to help with doing the math in case xl restore
  fails with ERANGE as reported in bug#1209311</changelog>
  <changelog author="ohering@suse.de" date="1690891200">- Handle potential off-by-one errors in libxc-sr-xg_sr_bitmap.patch
  A bit is an index in bitmap, while bits is the allocated size
  of the bitmap.</changelog>
  <changelog author="carnold@suse.com" date="1691496000">- Update to Xen 4.17.2 bug fix release (bsc#1027519)
  xen-4.17.2-testing-src.tar.bz2
  * No upstream changelog found in sources or webpage
- bsc#1214082 - VUL-0: CVE-2023-20569: xen: x86/AMD: Speculative
  Return Stack Overflow (XSA-434)
- bsc#1214083 - VUL-0: CVE-2022-40982: xen: x86/Intel: Gather Data
  Sampling (XSA-435)
- Dropped patches contained in new tarball
  64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch
  645dec48-AMD-IOMMU-assert-boolean-enum.patch
  64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch
  646b782b-PCI-pci_get_pdev-respect-segment.patch
  647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch
  648863fc-AMD-IOMMU-Invalidate-All-check.patch
  64bea1b2-x86-AMD-Zenbleed.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1691668800">- bsc#1212684 - xentop fails with long interface name
  64d33a57-libxenstat-Linux-nul-terminate-string.patch</changelog>
  <changelog author="ohering@suse.de" date="1691928000">- Handle potential unaligned access to bitmap in
  libxc-sr-restore-hvm-legacy-superpage.patch
  If setting BITS_PER_LONG at once, the initial bit must be aligned</changelog>
  <changelog author="carnold@suse.com" date="1694174400">- bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow
  reference dropped too early for 64-bit PV guests (XSA-438)
  xsa438.patch</changelog>
  <changelog author="carnold@suse.com" date="1695038400">- bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional
  execution leak via division by zero (XSA-439)
  xsa439-00.patch
  xsa439-01.patch
  xsa439-02.patch
  xsa439-03.patch
  xsa439-04.patch
  xsa439-05.patch
  xsa439-06.patch
  xsa439-07.patch
  xsa439-08.patch
  xsa439-09.patch</changelog>
  <changelog author="carnold@suse.com" date="1695816000">- bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A
  transaction conflict can crash C Xenstored (XSA-440)
  xsa440.patch
- bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU
  TLB flushing (XSA-442)
  xsa442.patch
- bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple
  vulnerabilities in libfsimage disk handling (XSA-443)
  xsa443-01.patch
  xsa443-02.patch
  xsa443-03.patch
  xsa443-04.patch
  xsa443-05.patch
  xsa443-06.patch
  xsa443-07.patch
  xsa443-08.patch
  xsa443-09.patch
  xsa443-10.patch
  xsa443-11.patch
- bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD:
  Debug Mask handling (XSA-444)
  xsa444-1.patch
  xsa444-2.patch</changelog>
</package>
<package pkgid="48b21b588a6a119a31fcb49a5dd3eae3e061984bf045ef85817cac04d583eb45" name="xen-libs" arch="x86_64">
  <version epoch="0" ver="4.17.2_06" rel="150500.3.12.1"/>
  <changelog author="carnold@suse.com" date="1677758400">- bsc#1208736 - GCC 13: xen package fails
  bunzip-gcc13.patch
  altp2m-gcc13.patch
- Drop gcc13-fixes.patch</changelog>
  <changelog author="carnold@suse.com" date="1678190400">- bsc#1209017 - VUL-0: CVE-2022-42332: xen: x86 shadow plus
  log-dirty mode use-after-free (XSA-427)
  xsa427.patch
- bsc#1209018 - VUL-0: CVE-2022-42333,CVE-2022-42334: xen: x86/HVM
  pinned cache attributes mis-handling (XSA-428)
  xsa428-1.patch
  xsa428-2.patch
- bsc#1209019 - VUL-0: CVE-2022-42331: xen: x86: speculative
  vulnerability in 32bit SYSCALL path (XSA-429)
  xsa429.patch</changelog>
  <changelog author="ohering@suse.de" date="1678968000">- bsc#1209245 - fix host-assisted kexec/kdump for HVM domUs
  libxl.fix-guest-kexec-skip-cpuid-policy.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1679572800">- Upstream bug fixes (bsc#1027519)
  63a03b73-VMX-VMExit-based-BusLock-detection.patch
  63a03ba6-VMX-INTR_SHADOW_NMI-helper.patch
  63a03bce-VMX-Notify-VMExit.patch
  63e53ac9-x86-CPUID-leaves-7-1-ecx-edx.patch
  63e53ac9-x86-disable-CET-SS-when-fractured-updates.patch
  63f4d045-x86-ucode-AMD-apply-early-on-all-threads.patch
  63fe06e0-x86-ucode-AMD-apply-late-on-all-threads.patch
  641041e8-VT-d-constrain-IGD-check.patch
  6419697d-AMD-IOMMU-no-XT-x2APIC-phys.patch
- Use "proper" upstream backports:
  640f3035-x86-altp2m-help-gcc13.patch
  64104238-bunzip-gcc13.patch
  64199e0c-x86-shadow-account-for-log-dirty-mode.patch
  64199e0d-x86-HVM-bound-number-of-pca-regions.patch
  64199e0e-x86-HVM-serialize-pca-list-manipulation.patch
  64199e0f-x86-spec-ctrl-defer-CR4_PV32_RESTORE-for-CSTAR.patch
- ... in place of:
  bunzip-gcc13.patch
  altp2m-gcc13.patch
  xsa427.patch
  xsa428-1.patch
  xsa428-2.patch
  xsa429.patch</changelog>
  <changelog author="carnold@suse.com" date="1680264000">- Not building the shim is correctly handled by --disable-pvshim
  Drop disable-building-pv-shim.patch</changelog>
  <changelog author="carnold@suse.com" date="1681214400">- bsc#1210315 - VUL-0: CVE-2022-42335: xen: x86 shadow paging
  arbitrary pointer dereference (XSA-430)
  xsa430.patch</changelog>
  <changelog author="carnold@suse.com" date="1682596800">- Update to Xen 4.17.1 bug fix release (bsc#1027519)
  xen-4.17.1-testing-src.tar.bz2
  * No upstream changelog found in sources or webpage
- Dropped patches contained in new tarball
  63a03b73-VMX-VMExit-based-BusLock-detection.patch
  63a03ba6-VMX-INTR_SHADOW_NMI-helper.patch
  63a03bce-VMX-Notify-VMExit.patch
  63a03e28-x86-high-freq-TSC-overflow.patch
  63c05478-VMX-calculate-model-specific-LBRs-once.patch
  63c05478-VMX-support-CPUs-without-model-specific-LBR.patch
  63d24e91-tools-xenstore-revert-simplify-loop-handling.patch
  63e53ac9-x86-CPUID-leaves-7-1-ecx-edx.patch
  63e53ac9-x86-disable-CET-SS-when-fractured-updates.patch
  63ebca9c-x86-spec-ctrl-Mitigate-Cross-Thread-Return-Address-Predictions.patch
  63f4d045-x86-ucode-AMD-apply-early-on-all-threads.patch
  63fe06e0-x86-ucode-AMD-apply-late-on-all-threads.patch
  640f3035-x86-altp2m-help-gcc13.patch
  641041e8-VT-d-constrain-IGD-check.patch
  64104238-bunzip-gcc13.patch
  6419697d-AMD-IOMMU-no-XT-x2APIC-phys.patch
  64199e0c-x86-shadow-account-for-log-dirty-mode.patch
  64199e0d-x86-HVM-bound-number-of-pca-regions.patch
  64199e0e-x86-HVM-serialize-pca-list-manipulation.patch
  64199e0f-x86-spec-ctrl-defer-CR4_PV32_RESTORE-for-CSTAR.patch
  libxl.fix-guest-kexec-skip-cpuid-policy.patch
  xsa430.patch</changelog>
  <changelog author="carnold@suse.com" date="1682683200">- bsc#1209237 - xen-syms doesn't contain debug-info
  643e3810-CONFIG_DEBUG_INFO-no-EXPERT.patch
  643e387f-xen-update-CONFIG_DEBUG_INFO-help-text.patch
  6447a8fd-x86-EFI-permit-crash-dump-analysis.patch</changelog>
  <changelog author="carnold@suse.com" date="1683201600">- bsc#1210570 - gcc-13 realloc use-after-free analysis error
  64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch</changelog>
  <changelog author="carnold@suse.com" date="1684756800">- bsc#1211433 - VUL-0: CVE-2022-42336: xen: Mishandling of guest
  SSBD selection on AMD hardware (XSA-431)
  64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1688644800">- Upstream bug fixes (bsc#1027519)
  645dec48-AMD-IOMMU-assert-boolean-enum.patch
  646b782b-PCI-pci_get_pdev-respect-segment.patch
  647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch
  648863fc-AMD-IOMMU-Invalidate-All-check.patch</changelog>
  <changelog author="carnold@suse.com" date="1690286400">- bsc#1213616 - VUL-0: CVE-2023-20593: xen: x86/AMD: Zenbleed
  (XSA-433)
  64bea1b2-x86-AMD-Zenbleed.patch</changelog>
  <changelog author="ohering@suse.de" date="1690545600">- Add more debug to libxc-sr-track-migration-time.patch
  This is supposed to help with doing the math in case xl restore
  fails with ERANGE as reported in bug#1209311</changelog>
  <changelog author="ohering@suse.de" date="1690891200">- Handle potential off-by-one errors in libxc-sr-xg_sr_bitmap.patch
  A bit is an index in bitmap, while bits is the allocated size
  of the bitmap.</changelog>
  <changelog author="carnold@suse.com" date="1691496000">- Update to Xen 4.17.2 bug fix release (bsc#1027519)
  xen-4.17.2-testing-src.tar.bz2
  * No upstream changelog found in sources or webpage
- bsc#1214082 - VUL-0: CVE-2023-20569: xen: x86/AMD: Speculative
  Return Stack Overflow (XSA-434)
- bsc#1214083 - VUL-0: CVE-2022-40982: xen: x86/Intel: Gather Data
  Sampling (XSA-435)
- Dropped patches contained in new tarball
  64525c61-tools-libs-guest-assist-gcc13s-realloc-analyzer.patch
  645dec48-AMD-IOMMU-assert-boolean-enum.patch
  64639e84-amd-fix-legacy-setting-of-SSBD-on-AMD-Family-17h.patch
  646b782b-PCI-pci_get_pdev-respect-segment.patch
  647dfb0e-x86-missing-unlock-in-microcode_update_helper.patch
  648863fc-AMD-IOMMU-Invalidate-All-check.patch
  64bea1b2-x86-AMD-Zenbleed.patch</changelog>
  <changelog author="jbeulich@suse.com" date="1691668800">- bsc#1212684 - xentop fails with long interface name
  64d33a57-libxenstat-Linux-nul-terminate-string.patch</changelog>
  <changelog author="ohering@suse.de" date="1691928000">- Handle potential unaligned access to bitmap in
  libxc-sr-restore-hvm-legacy-superpage.patch
  If setting BITS_PER_LONG at once, the initial bit must be aligned</changelog>
  <changelog author="carnold@suse.com" date="1694174400">- bsc#1215145 - VUL-0: CVE-2023-34322: xen: top-level shadow
  reference dropped too early for 64-bit PV guests (XSA-438)
  xsa438.patch</changelog>
  <changelog author="carnold@suse.com" date="1695038400">- bsc#1215474 - VUL-0: CVE-2023-20588: xen: AMD CPU transitional
  execution leak via division by zero (XSA-439)
  xsa439-00.patch
  xsa439-01.patch
  xsa439-02.patch
  xsa439-03.patch
  xsa439-04.patch
  xsa439-05.patch
  xsa439-06.patch
  xsa439-07.patch
  xsa439-08.patch
  xsa439-09.patch</changelog>
  <changelog author="carnold@suse.com" date="1695816000">- bsc#1215744 - VUL-0: CVE-2023-34323: xen: xenstored: A
  transaction conflict can crash C Xenstored (XSA-440)
  xsa440.patch
- bsc#1215746 - VUL-0: CVE-2023-34326: xen: x86/AMD: missing IOMMU
  TLB flushing (XSA-442)
  xsa442.patch
- bsc#1215747 - VUL-0: CVE-2023-34325: xen: Multiple
  vulnerabilities in libfsimage disk handling (XSA-443)
  xsa443-01.patch
  xsa443-02.patch
  xsa443-03.patch
  xsa443-04.patch
  xsa443-05.patch
  xsa443-06.patch
  xsa443-07.patch
  xsa443-08.patch
  xsa443-09.patch
  xsa443-10.patch
  xsa443-11.patch
- bsc#1215748 - VUL-0: CVE-2023-34327,CVE-2023-34328: xen: x86/AMD:
  Debug Mask handling (XSA-444)
  xsa444-1.patch
  xsa444-2.patch</changelog>
</package>
<package pkgid="28cdb6f3c64ade615a07dce3a7b48e78bfcdda9a041c7c50d2175fa12c447b62" name="zchunk" arch="src">
  <version epoch="0" ver="1.1.16" rel="150400.3.7.1"/>
  <changelog author="ngompa13@gmail.com" date="1530792000">- Initial packaging based on Mageia package</changelog>
  <changelog author="ngompa13@gmail.com" date="1531828800">- Update to 0.7.6
  + SHA-512 and SHA-512/128 support
  + New default chunk checksum type SHA-512/128
  + Automatic chunking moved into libzck and is now default
  + New option to disable automatic chunking
  + Bugfixes</changelog>
  <changelog author="mpluskal@suse.com" date="1531915200">- Do not manually specify dependencies which are automatically
  generated
- Make requirements of devel package less strict</changelog>
  <changelog author="ngompa13@gmail.com" date="1538222400">- Rebase to 0.9.11
  + Fix small bug where creating a zck_dl context fails when zck
    context is NULL
  + Fix security bugs found by Coverity
  + Fix test failures for zstd &lt;= 1.3.4
  + Add gen_xml_dictionary to libexecdir with zck_ prefix
  + Fix intermittent bug where auto-chunking wasn't deterministic
  + ABI (but not API change) - Use bool from stdbool.h
  + Allow specification of output file in zck
  + Set minimum and maximum chunk sizes for both automatic and
    manual chunking
  + New error handling functions
  + File format changes
  + API changes
- Make requirements between subpackages stricter to avoid issues
  due to inter-subpackage ABI/API changes</changelog>
  <changelog author="ngompa13@gmail.com" date="1538222401">- Bump meson build dependency to match meson.build requirement</changelog>
  <changelog author="aloisio@gmx.com" date="1540814400">- Update to version 0.9.13
  * Add read support for zchunk files with optional flags
  * Fix tests for zstd-1.3.6</changelog>
  <changelog author="ngompa13@gmail.com" date="1545048000">- Update to version 0.9.17
  + Turn off some tests for big-endian architectures since zstd
    isn't deterministic on them
  + Add zck_gen_zdict binary to generate optimal zdict for a zchunk file
  + Add functions to API to simplify extracting a single chunk
  + Change default zstd compression to 9 for a 6x speed increase in
    compression speed for a 5% increase in compression size
  + Switch from optional flags to more robust optional elements
  + Sanity check hex hashes passed in as an option</changelog>
  <changelog author="ngompa13@gmail.com" date="1548244800">- Update to version 1.0.2
  + Use hash table for finding identical chunks, speeding up process
    considerably
  + Add test case to verify that identical chunk checking is working</changelog>
  <changelog author="ngompa13@gmail.com" date="1548331200">- Backport patch from upstream to fix bugs discovered by Coverity
  + Add patch: 0001-Fix-some-small-bugs-found-by-Coverity.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1548331201">- Update to version 1.0.3
  + Fix some small bugs found by Coverity
  + Fix memory leak and off-by-one errors
- Drop patches part of 1.0.3 release
  + 0001-Fix-some-small-bugs-found-by-Coverity.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1554033600">- Update to version 1.1.0
  + Fix multipart boundary bug when dealing with lighttpd servers
  + Optimize chunk matching while downloading, significantly reducing CPU usage</changelog>
  <changelog author="mpluskal@suse.com" date="1576670400">- Update to version 1.1.4:
  * Simplify regex for detecting part header info
  * Fix coverity warnings
  * Open files with permissions 0666 and let umask(2) do its job.
  * Multipart boundary field can be quoted.</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Update to version 1.1.5
  + Handle write errors correctly</changelog>
  <changelog author="dimstar@opensuse.org" date="1609761600">- Add d2eae512bee09a4047cfe586de12f644d73b0736.patch: Fix build
  with zstd 1.4.7+.</changelog>
  <changelog author="rpm@fthiessen.de" date="1619438400">- Update to version 1.1.9
  * Handle zstd 1.4.7+
  * Update documentation
  * unzck: require a *.zck extension
  * General bug fixes
- Dropped upstream merged
  d2eae512bee09a4047cfe586de12f644d73b0736.patch
- Add fix-test-argp.patch: Fix argp detection</changelog>
  <changelog author="rpm@fthiessen.de" date="1620043200">- Update to version 1.1.11
  * Fix memory leak of zck-&gt;prep_digest
  * Fix argp detection
  * Handle certain rare web servers that don't start with \r\n
- Drop upstream merged fix-test-argp.patch</changelog>
  <changelog author="ismail@i10z.com" date="1621080000">- Update to version 1.1.12
  * Update testsuite for zstd 1.5</changelog>
  <changelog author="ismail@i10z.com" date="1621598400">- Update to version 1.1.14
  * Final fixes for zstd 1.5 support</changelog>
  <changelog author="rpm@fthiessen.de" date="1624536000">- Update to version 1.1.16
  * Fix major bug when compressing with dictionary</changelog>
  <changelog author="ali.abdallah@suse.com" date="1697716800">- Fix CVE-2023-46228, bsc#1216268
  * Handle overflow errors in malformed zchunk files.
- Added patch:
  * CVE-2023-46228.patch</changelog>
</package>
<package pkgid="c0cf79712be60deb670e7096b7e674cdd834c6a301c33592baee0b048961c89c" name="zlib" arch="src">
  <version epoch="0" ver="1.2.13" rel="150500.4.3.1"/>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="coolo@suse.com" date="1600257600">- Provide a testsuite subpackage to run post-build validation</changelog>
  <changelog author="lnussel@suse.de" date="1603886400">- install to /usr (boo#1029961)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1604923200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1647000000">- Don't install (internal) crypt.h header in minizip
  * minizip-dont-install-crypt-header.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch - CVE-2018-25032
- Update 410.patch
  * Remove included patches:
    bsc1174551-fxi-imcomplete-raw-streams.patch
    zlib-compression-switching.patch
    zlib-s390x-z15-fix-hw-compression.patch
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch</changelog>
  <changelog author="meissner@suse.com" date="1656763200">- switch to https urls</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661256000">- Update to 1.2.12:
  * A lot of bug fixes
  * Improve speed of crc32 functions
  * Use ARM crc32 instructions if the ARM architecture has them
  For the complete changes, see ChangeLog
- Fixes CVE-2022-37434,  heap-based buffer over-read or buffer overflow in
  inflate.c via a large gzip header extra field
  (CVE-2022-37434, bsc#1202175)
- Added patches:
  * zlib-1.2.11-covscan-issues-rhel9.patch
  * zlib-1.2.11-covscan-issues.patch
  * zlib-1.2.12-s390-vectorize-crc32.patch
  * zlib-1.2.12-optimized-crc32-power8.patch
  * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.12-fix-configure.patch
  * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch
  * zlib-1.2.12-fix-CVE-2022-37434.patch
  * zlib-1.2.5-minizip-fixuncrypt.patch
- Removed patches:
  * bsc1197459.patch (upstreamed)
  * zlib-power8-fate325307.patch
    (replaced by zlib-1.2.12-optimized-crc32-power8.patch)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
    (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch)
  * 410.patch
    (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch)
- Refreshed patches:
  * zlib-format.patch
  * zlib-no-version-check.patch
- Disable profiling since it breaks tests
- Update zlib-rpmlintrc</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665403200">- Add Power8 optimizations:
  * zlib-1.2.12-add-optimized-slide_hash-for-power.patch
  * zlib-1.2.12-add-vectorized-longest_match-for-power.patch
  * zlib-1.2.12-adler32-vector-optimizations-for-power.patch
  * zlib-1.2.12-fix-invalid-memory-access-on-ppc-and-ppc64.patch
- Update zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch</changelog>
  <changelog author="dmueller@suse.com" date="1670760000">- build zlib with optflags again</changelog>
  <changelog author="danilo.spinella@suse.com" date="1674129600">- Update to 1.13:
  * Fix configure issue that discarded provided CC definition
  * Correct incorrect inputs provided to the CRC functions
  * Repair prototypes and exporting of new CRC functions
  * Fix inflateBack to detect invalid input with distances too far
  * Have infback() deliver all of the available output up to any error
  * Fix a bug when getting a gzip header extra field with inflate()
  * Fix bug in block type selection when Z_FIXED used
  * Tighten deflateBound bounds
  * Remove deleted assembler code references
  * Various portability and appearance improvements
- Added patches:
  * zlib-1.2.13-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.13-fix-bug-deflateBound.patch
  * zlib-1.2.13-optimized-s390.patch
- Refreshed patches:
  * zlib-1.2.12-add-optimized-slide_hash-for-power.patch
  * zlib-1.2.12-add-vectorized-longest_match-for-power.patch
  * zlib-1.2.12-s390-vectorize-crc32.patch
- Removed patches:
  * zlib-1.2.12-fix-configure.patch
  * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.12-optimized-crc32-power8.patch
  * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch
  * zlib-1.2.12-fix-CVE-2022-37434.patch
  * zlib-1.2.11-optimized-s390.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1683201600">- Fix deflateBound() before deflateInit(), bsc#1210593, bsc#1211005
  bsc1210593.patch</changelog>
  <changelog author="oss@danyspin97.org" date="1697716800">- Fix CVE-2023-45853, integer overflow and resultant heap-based buffer
  overflow in zipOpenNewFileInZip4_6, bsc#1216378
  * CVE-2023-45853.patch</changelog>
</package>
<package pkgid="72876b386af3b49e707d3464dc0c15b6700f16fc09d7b99f27f1eeb406f8f1ec" name="zlib-devel" arch="aarch64">
  <version epoch="0" ver="1.2.13" rel="150500.4.3.1"/>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="coolo@suse.com" date="1600257600">- Provide a testsuite subpackage to run post-build validation</changelog>
  <changelog author="lnussel@suse.de" date="1603886400">- install to /usr (boo#1029961)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1604923200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1647000000">- Don't install (internal) crypt.h header in minizip
  * minizip-dont-install-crypt-header.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch - CVE-2018-25032
- Update 410.patch
  * Remove included patches:
    bsc1174551-fxi-imcomplete-raw-streams.patch
    zlib-compression-switching.patch
    zlib-s390x-z15-fix-hw-compression.patch
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch</changelog>
  <changelog author="meissner@suse.com" date="1656763200">- switch to https urls</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661256000">- Update to 1.2.12:
  * A lot of bug fixes
  * Improve speed of crc32 functions
  * Use ARM crc32 instructions if the ARM architecture has them
  For the complete changes, see ChangeLog
- Fixes CVE-2022-37434,  heap-based buffer over-read or buffer overflow in
  inflate.c via a large gzip header extra field
  (CVE-2022-37434, bsc#1202175)
- Added patches:
  * zlib-1.2.11-covscan-issues-rhel9.patch
  * zlib-1.2.11-covscan-issues.patch
  * zlib-1.2.12-s390-vectorize-crc32.patch
  * zlib-1.2.12-optimized-crc32-power8.patch
  * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.12-fix-configure.patch
  * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch
  * zlib-1.2.12-fix-CVE-2022-37434.patch
  * zlib-1.2.5-minizip-fixuncrypt.patch
- Removed patches:
  * bsc1197459.patch (upstreamed)
  * zlib-power8-fate325307.patch
    (replaced by zlib-1.2.12-optimized-crc32-power8.patch)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
    (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch)
  * 410.patch
    (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch)
- Refreshed patches:
  * zlib-format.patch
  * zlib-no-version-check.patch
- Disable profiling since it breaks tests
- Update zlib-rpmlintrc</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665403200">- Add Power8 optimizations:
  * zlib-1.2.12-add-optimized-slide_hash-for-power.patch
  * zlib-1.2.12-add-vectorized-longest_match-for-power.patch
  * zlib-1.2.12-adler32-vector-optimizations-for-power.patch
  * zlib-1.2.12-fix-invalid-memory-access-on-ppc-and-ppc64.patch
- Update zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch</changelog>
  <changelog author="dmueller@suse.com" date="1670760000">- build zlib with optflags again</changelog>
  <changelog author="danilo.spinella@suse.com" date="1674129600">- Update to 1.13:
  * Fix configure issue that discarded provided CC definition
  * Correct incorrect inputs provided to the CRC functions
  * Repair prototypes and exporting of new CRC functions
  * Fix inflateBack to detect invalid input with distances too far
  * Have infback() deliver all of the available output up to any error
  * Fix a bug when getting a gzip header extra field with inflate()
  * Fix bug in block type selection when Z_FIXED used
  * Tighten deflateBound bounds
  * Remove deleted assembler code references
  * Various portability and appearance improvements
- Added patches:
  * zlib-1.2.13-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.13-fix-bug-deflateBound.patch
  * zlib-1.2.13-optimized-s390.patch
- Refreshed patches:
  * zlib-1.2.12-add-optimized-slide_hash-for-power.patch
  * zlib-1.2.12-add-vectorized-longest_match-for-power.patch
  * zlib-1.2.12-s390-vectorize-crc32.patch
- Removed patches:
  * zlib-1.2.12-fix-configure.patch
  * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.12-optimized-crc32-power8.patch
  * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch
  * zlib-1.2.12-fix-CVE-2022-37434.patch
  * zlib-1.2.11-optimized-s390.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1683201600">- Fix deflateBound() before deflateInit(), bsc#1210593, bsc#1211005
  bsc1210593.patch</changelog>
  <changelog author="oss@danyspin97.org" date="1697716800">- Fix CVE-2023-45853, integer overflow and resultant heap-based buffer
  overflow in zipOpenNewFileInZip4_6, bsc#1216378
  * CVE-2023-45853.patch</changelog>
</package>
<package pkgid="cd7a582806700401b638d90e79c07b6f4db63429527787cbff25554ce12990b0" name="zlib-devel" arch="s390x">
  <version epoch="0" ver="1.2.13" rel="150500.4.3.1"/>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="coolo@suse.com" date="1600257600">- Provide a testsuite subpackage to run post-build validation</changelog>
  <changelog author="lnussel@suse.de" date="1603886400">- install to /usr (boo#1029961)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1604923200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1647000000">- Don't install (internal) crypt.h header in minizip
  * minizip-dont-install-crypt-header.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch - CVE-2018-25032
- Update 410.patch
  * Remove included patches:
    bsc1174551-fxi-imcomplete-raw-streams.patch
    zlib-compression-switching.patch
    zlib-s390x-z15-fix-hw-compression.patch
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch</changelog>
  <changelog author="meissner@suse.com" date="1656763200">- switch to https urls</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661256000">- Update to 1.2.12:
  * A lot of bug fixes
  * Improve speed of crc32 functions
  * Use ARM crc32 instructions if the ARM architecture has them
  For the complete changes, see ChangeLog
- Fixes CVE-2022-37434,  heap-based buffer over-read or buffer overflow in
  inflate.c via a large gzip header extra field
  (CVE-2022-37434, bsc#1202175)
- Added patches:
  * zlib-1.2.11-covscan-issues-rhel9.patch
  * zlib-1.2.11-covscan-issues.patch
  * zlib-1.2.12-s390-vectorize-crc32.patch
  * zlib-1.2.12-optimized-crc32-power8.patch
  * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.12-fix-configure.patch
  * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch
  * zlib-1.2.12-fix-CVE-2022-37434.patch
  * zlib-1.2.5-minizip-fixuncrypt.patch
- Removed patches:
  * bsc1197459.patch (upstreamed)
  * zlib-power8-fate325307.patch
    (replaced by zlib-1.2.12-optimized-crc32-power8.patch)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
    (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch)
  * 410.patch
    (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch)
- Refreshed patches:
  * zlib-format.patch
  * zlib-no-version-check.patch
- Disable profiling since it breaks tests
- Update zlib-rpmlintrc</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665403200">- Add Power8 optimizations:
  * zlib-1.2.12-add-optimized-slide_hash-for-power.patch
  * zlib-1.2.12-add-vectorized-longest_match-for-power.patch
  * zlib-1.2.12-adler32-vector-optimizations-for-power.patch
  * zlib-1.2.12-fix-invalid-memory-access-on-ppc-and-ppc64.patch
- Update zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch</changelog>
  <changelog author="dmueller@suse.com" date="1670760000">- build zlib with optflags again</changelog>
  <changelog author="danilo.spinella@suse.com" date="1674129600">- Update to 1.13:
  * Fix configure issue that discarded provided CC definition
  * Correct incorrect inputs provided to the CRC functions
  * Repair prototypes and exporting of new CRC functions
  * Fix inflateBack to detect invalid input with distances too far
  * Have infback() deliver all of the available output up to any error
  * Fix a bug when getting a gzip header extra field with inflate()
  * Fix bug in block type selection when Z_FIXED used
  * Tighten deflateBound bounds
  * Remove deleted assembler code references
  * Various portability and appearance improvements
- Added patches:
  * zlib-1.2.13-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.13-fix-bug-deflateBound.patch
  * zlib-1.2.13-optimized-s390.patch
- Refreshed patches:
  * zlib-1.2.12-add-optimized-slide_hash-for-power.patch
  * zlib-1.2.12-add-vectorized-longest_match-for-power.patch
  * zlib-1.2.12-s390-vectorize-crc32.patch
- Removed patches:
  * zlib-1.2.12-fix-configure.patch
  * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.12-optimized-crc32-power8.patch
  * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch
  * zlib-1.2.12-fix-CVE-2022-37434.patch
  * zlib-1.2.11-optimized-s390.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1683201600">- Fix deflateBound() before deflateInit(), bsc#1210593, bsc#1211005
  bsc1210593.patch</changelog>
  <changelog author="oss@danyspin97.org" date="1697716800">- Fix CVE-2023-45853, integer overflow and resultant heap-based buffer
  overflow in zipOpenNewFileInZip4_6, bsc#1216378
  * CVE-2023-45853.patch</changelog>
</package>
<package pkgid="16b0c66f6384d2ed18894441075a928d263897e8fb1c0c496f9ee41f3a1c2411" name="zlib-devel" arch="x86_64">
  <version epoch="0" ver="1.2.13" rel="150500.4.3.1"/>
  <changelog author="brogers@suse.com" date="1562846400">- Tweak zlib-power8-fate325307.patch to have type of crc32_vpmsum
  conform to usage
  bsc#1141059</changelog>
  <changelog author="tchvatal@suse.com" date="1563364800">- Update the s390 patchset bsc#1137624:
  * 410.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1571659200">- Add SUSE specific patch to fix bsc#1138793, we simply don't want
  to test if the app was linked with exactly same version of zlib
  like the one that is present on the runtime:
  * zlib-no-version-check.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1572350400">- Update the zlib-no-version-check.patch to be even more forgiving
  with the versions on the zlib to allow updates without rebuilds</changelog>
  <changelog author="tchvatal@suse.com" date="1587643200">- Update 410.patch to contain latest fixes from IBM bsc#1166260
  * The build behaviour changed</changelog>
  <changelog author="lidong.zhong@suse.com" date="1596715200">- Permit a deflateParams() parameter change as soon as possible(bsc#1174736)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  Fix DFLTCC not flushing EOBS when creating raw streams(bsc#1174551)
  * bsc1174551-fxi-imcomplete-raw-streams.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1598529600">- Set -DDFLTCC_LEVEL_MASK=0x7e on s390/s390x jsc#13776</changelog>
  <changelog author="tchvatal@suse.com" date="1598616000">- Add patch to fix compression level switching
  bsc#1175811 bsc#1175830 bsc#1175831
  * zlib-compression-switching.patch</changelog>
  <changelog author="coolo@suse.com" date="1600257600">- Provide a testsuite subpackage to run post-build validation</changelog>
  <changelog author="lnussel@suse.de" date="1603886400">- install to /usr (boo#1029961)</changelog>
  <changelog author="ali.abdallah@suse.com" date="1604923200">- Fix hw compression on z15 bsc#1176201
- Add zlib-s390x-z15-fix-hw-compression.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1647000000">- Don't install (internal) crypt.h header in minizip
  * minizip-dont-install-crypt-header.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1648209600">- Fix memory corruption on deflate, bsc#1197459
  * bsc1197459.patch - CVE-2018-25032
- Update 410.patch
  * Remove included patches:
    bsc1174551-fxi-imcomplete-raw-streams.patch
    zlib-compression-switching.patch
    zlib-s390x-z15-fix-hw-compression.patch
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch</changelog>
  <changelog author="meissner@suse.com" date="1656763200">- switch to https urls</changelog>
  <changelog author="danilo.spinella@suse.com" date="1661256000">- Update to 1.2.12:
  * A lot of bug fixes
  * Improve speed of crc32 functions
  * Use ARM crc32 instructions if the ARM architecture has them
  For the complete changes, see ChangeLog
- Fixes CVE-2022-37434,  heap-based buffer over-read or buffer overflow in
  inflate.c via a large gzip header extra field
  (CVE-2022-37434, bsc#1202175)
- Added patches:
  * zlib-1.2.11-covscan-issues-rhel9.patch
  * zlib-1.2.11-covscan-issues.patch
  * zlib-1.2.12-s390-vectorize-crc32.patch
  * zlib-1.2.12-optimized-crc32-power8.patch
  * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.12-fix-configure.patch
  * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch
  * zlib-1.2.12-fix-CVE-2022-37434.patch
  * zlib-1.2.5-minizip-fixuncrypt.patch
- Removed patches:
  * bsc1197459.patch (upstreamed)
  * zlib-power8-fate325307.patch
    (replaced by zlib-1.2.12-optimized-crc32-power8.patch)
  * bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
    (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch)
  * 410.patch
    (replaced by zlib-1.2.12-IBM-Z-hw-accelrated-deflate-s390x.patch)
- Refreshed patches:
  * zlib-format.patch
  * zlib-no-version-check.patch
- Disable profiling since it breaks tests
- Update zlib-rpmlintrc</changelog>
  <changelog author="danilo.spinella@suse.com" date="1665403200">- Add Power8 optimizations:
  * zlib-1.2.12-add-optimized-slide_hash-for-power.patch
  * zlib-1.2.12-add-vectorized-longest_match-for-power.patch
  * zlib-1.2.12-adler32-vector-optimizations-for-power.patch
  * zlib-1.2.12-fix-invalid-memory-access-on-ppc-and-ppc64.patch
- Update zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch</changelog>
  <changelog author="dmueller@suse.com" date="1670760000">- build zlib with optflags again</changelog>
  <changelog author="danilo.spinella@suse.com" date="1674129600">- Update to 1.13:
  * Fix configure issue that discarded provided CC definition
  * Correct incorrect inputs provided to the CRC functions
  * Repair prototypes and exporting of new CRC functions
  * Fix inflateBack to detect invalid input with distances too far
  * Have infback() deliver all of the available output up to any error
  * Fix a bug when getting a gzip header extra field with inflate()
  * Fix bug in block type selection when Z_FIXED used
  * Tighten deflateBound bounds
  * Remove deleted assembler code references
  * Various portability and appearance improvements
- Added patches:
  * zlib-1.2.13-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.13-fix-bug-deflateBound.patch
  * zlib-1.2.13-optimized-s390.patch
- Refreshed patches:
  * zlib-1.2.12-add-optimized-slide_hash-for-power.patch
  * zlib-1.2.12-add-vectorized-longest_match-for-power.patch
  * zlib-1.2.12-s390-vectorize-crc32.patch
- Removed patches:
  * zlib-1.2.12-fix-configure.patch
  * zlib-1.2.12-IBM-Z-hw-accelerated-deflate-s390x.patch
  * zlib-1.2.12-optimized-crc32-power8.patch
  * zlib-1.2.12-correct-inputs-provided-to-crc-func.patch
  * zlib-1.2.12-fix-CVE-2022-37434.patch
  * zlib-1.2.11-optimized-s390.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1683201600">- Fix deflateBound() before deflateInit(), bsc#1210593, bsc#1211005
  bsc1210593.patch</changelog>
  <changelog author="oss@danyspin97.org" date="1697716800">- Fix CVE-2023-45853, integer overflow and resultant heap-based buffer
  overflow in zipOpenNewFileInZip4_6, bsc#1216378
  * CVE-2023-45853.patch</changelog>
</package>
</otherdata>